Todd Miller's sudo version 1.8.20 and earlier is vulnerable to an input validation (embedded spaces) in the get_process_ttyname() function resulting in information disclosure and command execution.
CVSS Details
- CVSS 3.0 Base Score: 6.4
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade sudo-debuginfoUpgrade sudo-develUpgrade sudo | Apr 27, 2020 | Jun 5, 2017 |
| Amazon_linux | — | Upgrade sudo | Jun 7, 2017 | May 30, 2017 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jun 5, 2017 |
| Centos_linux | — | Upgrade sudo-develUpgrade sudoUpgrade sudo-debuginfo | Jun 5, 2017 | May 30, 2017 |
| Debian | — | Upgrade sudo | Jun 5, 2017 | May 30, 2017 |
| Gentoo Linux | — | Upgrade app-admin/sudo. | Oct 30, 2017 | Jun 5, 2017 |
| Huawei Euleros 2_0_sp1 | — | Upgrade sudo | Nov 30, 2017 | Jun 5, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade sudo | Nov 30, 2017 | Jun 5, 2017 |
| Oracle_linux | — | Upgrade sudoUpgrade sudo-devel | Jun 5, 2017 | May 30, 2017 |
| Redhat_linux | — | Upgrade sudoUpgrade sudo-develUpgrade sudo-debuginfo | Jun 5, 2017 | May 30, 2017 |
| Suse | — | Upgrade sudo-develUpgrade sudo-plugin-pythonUpgrade sudo | Jun 5, 2017 | May 30, 2017 |
| Ubuntu | — | Upgrade sudo-ldapUpgrade sudo | Jun 6, 2017 | May 30, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub