In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. (pwfeedback is a default setting in Linux Mint and elementary OS; however, it is NOT the default for upstream and many other packages, and would exist only if enabled by an administrator.) The attacker needs to deliver a long string to the stdin of getln() in tgetpass.c.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade sudo | Feb 11, 2020 | Jan 29, 2020 |
| Amazon Linux Ami 2 | — | Upgrade sudo-debuginfoUpgrade sudo-develUpgrade sudo | Apr 27, 2020 | Jan 29, 2020 |
| Amazon_linux | — | Upgrade sudo | Mar 19, 2020 | Jan 29, 2020 |
| Apple Osx Sudo | — | Upgrade macOS to the latest versionApply OS X security update 2020-001 MojaveApply OS X security update 2020-001 High Sierra | Jan 29, 2020 | Jan 29, 2020 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jan 29, 2020 |
| Centos_linux | — | Upgrade sudo-develUpgrade sudoUpgrade sudo-debuginfoUpgrade sudo-debugsource | Feb 14, 2020 | Jan 29, 2020 |
| Debian | — | Upgrade sudo | Feb 3, 2020 | Jan 29, 2020 |
| Freebsd | — | Upgrade sudo | Feb 1, 2020 | Jan 30, 2020 |
| Gentoo Linux | — | Upgrade app-admin/sudo. | Mar 16, 2020 | Jan 29, 2020 |
| Huawei Euleros 2_0_sp2 | — | Upgrade sudo | Jun 17, 2020 | Jan 29, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade sudo | Apr 16, 2020 | Jan 29, 2020 |
| Huawei Euleros 2_0_sp5 | — | Upgrade sudo | Feb 24, 2020 | Jan 29, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade sudo | Feb 26, 2020 | Jan 29, 2020 |
| Huawei Euleros 2_0_sp9 | — | Upgrade sudo | Oct 26, 2020 | Jan 29, 2020 |
| Oracle Solaris | — | Upgrade security/sudo to version 1.8.31.1-11.4.24.0.1.75.1 on Solaris 11.4 | Jan 19, 2021 | Jan 29, 2020 |
| Oracle_linux | — | Upgrade sudo-develUpgrade sudo | Feb 19, 2020 | Jan 30, 2020 |
| Redhat Openshift | — | Upgrade redhat-coreos | Dec 29, 2020 | Jan 29, 2020 |
| Redhat_linux | — | Upgrade sudo-develUpgrade sudo-debuginfoUpgrade sudoUpgrade sudo-debugsource | Feb 14, 2020 | Jan 29, 2020 |
| Suse | — | Upgrade sudoUpgrade sudo-plugin-pythonUpgrade sudo-testUpgrade sudo-devel | Feb 19, 2020 | Jan 29, 2020 |
| Ubuntu | — | Upgrade sudo (Ubuntu Pro)Upgrade sudo-ldapUpgrade sudo-ldap (Ubuntu Pro)Upgrade sudo | Feb 4, 2020 | Jan 29, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub