In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to append arbitrary entries to the list of files to process. This can lead to privilege escalation. Affected versions are 1.8.0 through 1.9.12.p1. The problem exists because a user-specified editor may contain a "--" argument that defeats a protection mechanism, e.g., an EDITOR='vim -- /path/to/extra/file' value.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade sudo-python-pluginUpgrade sudo | Jan 25, 2023 | Jan 18, 2023 |
| Alpine Linux | — | Upgrade sudo | Aug 22, 2024 | Jan 18, 2023 |
| Amazon Linux Ami 2 | — | Upgrade sudoUpgrade sudo-debuginfoUpgrade sudo-devel | Mar 7, 2023 | Jan 18, 2023 |
| Amazon_linux | — | Upgrade sudo | Feb 7, 2023 | Jan 18, 2023 |
| Amazon_linux_2023 | — | Upgrade sudo-python-plugin-debuginfoUpgrade sudo-debugsourceUpgrade sudo-debuginfoUpgrade sudoUpgrade sudo-python-pluginUpgrade sudo-logsrvdUpgrade sudo-develUpgrade sudo-logsrvd-debuginfo | Feb 17, 2025 | Jan 18, 2023 |
| Apple Osx Accessibility | — | — | Oct 14, 2024 | Jan 18, 2023 |
| Apple Osx Accounts | — | — | Oct 14, 2024 | Jan 18, 2023 |
| Apple Osx Amd | — | — | Oct 14, 2024 | Jan 18, 2023 |
| Apple Osx Applemobilefileintegrity | — | — | Oct 14, 2024 | Jan 18, 2023 |
| Apple Osx Associateddomains | — | — | Oct 14, 2024 | Jan 18, 2023 |
| Apple Osx Contacts | — | — | Oct 14, 2024 | Jan 18, 2023 |
| Apple Osx Corelocation | — | — | Oct 14, 2024 | Jan 18, 2023 |
| Apple Osx Coreservices | — | — | Oct 14, 2024 | Jan 18, 2023 |
| Apple Osx Cups | — | — | Oct 14, 2024 | Jan 18, 2023 |
| Apple Osx Dcerpc | — | — | Oct 14, 2024 | Jan 18, 2023 |
| Apple Osx Desktopservices | — | — | Oct 14, 2024 | Jan 18, 2023 |
| Apple Osx Facegallery | — | — | Oct 14, 2024 | Jan 18, 2023 |
| Apple Osx Geoservices | — | — | Oct 14, 2024 | Jan 18, 2023 |
| Apple Osx Imageio | — | — | Oct 14, 2024 | Jan 18, 2023 |
| Apple Osx Iosurface | — | — | Oct 14, 2024 | Jan 18, 2023 |
| Apple Osx Iosurfaceaccelerator | — | — | Oct 14, 2024 | Jan 18, 2023 |
| Apple Osx Kernel | — | — | Oct 14, 2024 | Jan 18, 2023 |
| Apple Osx Launchservices | — | — | Oct 14, 2024 | Jan 18, 2023 |
| Apple Osx Libxml2 | — | — | Oct 14, 2024 | Jan 18, 2023 |
| Apple Osx Libxpc | — | — | Oct 14, 2024 | Jan 18, 2023 |
| Apple Osx Mallocstacklogging | — | — | Oct 14, 2024 | Jan 18, 2023 |
| Apple Osx Metal | — | — | Oct 14, 2024 | Jan 18, 2023 |
| Apple Osx Mobilestoragemounter | — | — | Oct 14, 2024 | Jan 18, 2023 |
| Apple Osx Modelio | — | — | Oct 14, 2024 | Jan 18, 2023 |
| Apple Osx Networkextension | — | — | Oct 14, 2024 | Jan 18, 2023 |
| Apple Osx Nsurlsession | — | — | Oct 14, 2024 | Jan 18, 2023 |
| Apple Osx Packagekit | — | — | Oct 14, 2024 | Jan 18, 2023 |
| Apple Osx Pdfkit | — | — | Oct 14, 2024 | Jan 18, 2023 |
| Apple Osx Perl | — | — | Oct 14, 2024 | Jan 18, 2023 |
| Apple Osx Photos | — | — | Oct 14, 2024 | Jan 18, 2023 |
| Apple Osx Quicklook | — | — | Oct 14, 2024 | Jan 18, 2023 |
| Apple Osx Sandbox | — | — | Oct 14, 2024 | Jan 18, 2023 |
| Apple Osx Screensaver | — | — | Oct 14, 2024 | Jan 18, 2023 |
| Apple Osx Security | — | — | Oct 14, 2024 | Jan 18, 2023 |
| Apple Osx Sharesheet | — | — | Oct 14, 2024 | Jan 18, 2023 |
| Apple Osx Shell | — | — | Oct 14, 2024 | Jan 18, 2023 |
| Apple Osx Shortcuts | — | — | Oct 14, 2024 | Jan 18, 2023 |
| Apple Osx Siri | — | — | Oct 14, 2024 | Jan 18, 2023 |
| Apple Osx Sqlite | — | — | Oct 14, 2024 | Jan 18, 2023 |
| Apple Osx Storagekit | — | — | Oct 14, 2024 | Jan 18, 2023 |
| Apple Osx Sudo | — | Upgrade macOS to the latest version | Sep 6, 2023 | Jan 18, 2023 |
| Centos_linux | — | Upgrade sudo-debuginfoUpgrade sudoUpgrade sudo-devel | Jan 24, 2023 | Jan 18, 2023 |
| Debian | — | Upgrade sudo | Jan 20, 2023 | Jan 18, 2023 |
| Dell Powerstore Dsa2023173 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Jun 21, 2023 |
| Gentoo Linux | — | Upgrade app-admin/sudo. | May 4, 2023 | Jan 18, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade sudo | Mar 20, 2023 | Jan 18, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade sudo | May 8, 2023 | Jan 18, 2023 |
| Huawei Euleros 2_0_sp5 | — | Upgrade sudo | Jun 9, 2023 | Jan 18, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade sudo | Apr 13, 2023 | Jan 18, 2023 |
| Huawei Euleros 2_0_sp9 | — | Upgrade sudo | Mar 9, 2023 | Jan 18, 2023 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Apr 11, 2023 |
| Oracle_linux | — | Upgrade sudoUpgrade sudo-python-pluginUpgrade sudo-devel | Jan 24, 2023 | Jan 18, 2023 |
| Redhat_linux | — | Upgrade sudo-python-plugin-debuginfoUpgrade sudo-python-pluginUpgrade sudo-develUpgrade sudo-debugsourceUpgrade sudo-debuginfoUpgrade sudo | Jan 24, 2023 | Jan 18, 2023 |
| Rocky_linux | — | Upgrade sudo-debugsourceUpgrade sudoUpgrade sudo-python-pluginUpgrade sudo-python-plugin-debuginfoUpgrade sudo-debuginfo | Mar 12, 2024 | Jan 18, 2023 |
| Suse | — | Upgrade sudoUpgrade sudo-testUpgrade sudo-develUpgrade sudo-plugin-python | Jan 20, 2023 | Jan 18, 2023 |
| Ubuntu | — | Upgrade sudo-ldap (Ubuntu Pro)Upgrade sudo-ldapUpgrade sudoUpgrade sudo (Ubuntu Pro) | Jan 19, 2023 | Jan 18, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jan 18, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub