In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. (pwfeedback is a default setting in Linux Mint and elementary OS; however, it is NOT the default for upstream and many other packages, and would exist only if enabled by an administrator.) The attacker needs to deliver a long string to the stdin of getln() in tgetpass.c.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade sudo | Feb 11, 2020 | Jan 29, 2020 |
| Amazon Linux Ami 2 | — | Upgrade sudo-debuginfoUpgrade sudoUpgrade sudo-devel | Apr 27, 2020 | Jan 29, 2020 |
| Amazon_linux | — | Upgrade sudo | Mar 19, 2020 | Jan 29, 2020 |
| Apple Osx Sudo | — | Apply OS X security update 2020-001 MojaveUpgrade macOS to the latest versionApply OS X security update 2020-001 High Sierra | Jan 29, 2020 | Jan 29, 2020 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jan 29, 2020 |
| Centos_linux | — | Upgrade sudo-debuginfoUpgrade sudo-debugsourceUpgrade sudo-develUpgrade sudo | Feb 14, 2020 | Jan 29, 2020 |
| Debian | — | Upgrade sudo | Feb 3, 2020 | Jan 29, 2020 |
| Freebsd | — | Upgrade sudo | Feb 1, 2020 | Jan 30, 2020 |
| Gentoo Linux | — | Upgrade app-admin/sudo. | Mar 16, 2020 | Jan 29, 2020 |
| Huawei Euleros 2_0_sp2 | — | Upgrade sudo | Jun 17, 2020 | Jan 29, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade sudo | Apr 16, 2020 | Jan 29, 2020 |
| Huawei Euleros 2_0_sp5 | — | Upgrade sudo | Feb 24, 2020 | Jan 29, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade sudo | Feb 26, 2020 | Jan 29, 2020 |
| Huawei Euleros 2_0_sp9 | — | Upgrade sudo | Oct 26, 2020 | Jan 29, 2020 |
| Oracle Solaris | — | Upgrade security/sudo to version 1.8.31.1-11.4.24.0.1.75.1 on Solaris 11.4 | Jan 19, 2021 | Jan 29, 2020 |
| Oracle_linux | — | Upgrade sudo-develUpgrade sudo | Feb 19, 2020 | Jan 30, 2020 |
| Redhat Openshift | — | Upgrade redhat-coreos | Dec 29, 2020 | Jan 29, 2020 |
| Redhat_linux | — | Upgrade sudo-debuginfoUpgrade sudo-debugsourceUpgrade sudoUpgrade sudo-devel | Feb 14, 2020 | Jan 29, 2020 |
| Suse | — | Upgrade sudo-testUpgrade sudo-develUpgrade sudoUpgrade sudo-plugin-python | Feb 19, 2020 | Jan 29, 2020 |
| Ubuntu | — | Upgrade sudo-ldapUpgrade sudo (Ubuntu Pro)Upgrade sudoUpgrade sudo-ldap (Ubuntu Pro) | Feb 4, 2020 | Jan 29, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub