Todd Miller's sudo version 1.8.20p1 and earlier is vulnerable to an input validation (embedded newlines) in the get_process_ttyname() function resulting in information disclosure and command execution.
CVSS Details
- CVSS 3.0 Base Score: 8.2
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade sudo | Aug 22, 2024 | Jun 5, 2017 |
| Amazon Linux Ami 2 | — | Upgrade sudo-develUpgrade sudoUpgrade sudo-debuginfo | Apr 27, 2020 | Jun 5, 2017 |
| Amazon_linux | — | Upgrade sudo | Jul 7, 2017 | Jun 5, 2017 |
| Centos_linux | — | Upgrade sudo-debuginfoUpgrade sudoUpgrade sudo-devel | Jun 23, 2017 | Jun 5, 2017 |
| Debian | — | Upgrade sudo | Feb 25, 2019 | Jun 5, 2017 |
| Gentoo Linux | — | Upgrade app-admin/sudo. | Oct 30, 2017 | Jun 5, 2017 |
| Huawei Euleros 2_0_sp1 | — | Upgrade sudo | Nov 30, 2017 | Jun 5, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade sudo | Nov 30, 2017 | Jun 5, 2017 |
| Oracle_linux | — | Upgrade sudoUpgrade sudo-devel | Jun 23, 2017 | Jun 2, 2017 |
| Redhat_linux | — | Upgrade sudoUpgrade sudo-develUpgrade sudo-debuginfo | Jun 23, 2017 | Jun 5, 2017 |
| Suse | — | Upgrade sudo-plugin-pythonUpgrade sudo-develUpgrade sudo | Jun 20, 2017 | Jun 5, 2017 |
| Ubuntu | — | Upgrade sudoUpgrade sudo-ldap (Ubuntu Pro)Upgrade sudo (Ubuntu Pro)Upgrade sudo-ldap | May 7, 2019 | Jun 5, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub