In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a "sudo -u \#$((0xffffffff))" command.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade sudo | Aug 22, 2024 | Oct 17, 2019 |
| Amazon Linux Ami 2 | — | Upgrade sudoUpgrade sudo-develUpgrade sudo-debuginfo | Apr 27, 2020 | Oct 17, 2019 |
| Amazon_linux | — | Upgrade sudo | Oct 15, 2019 | Oct 12, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Oct 17, 2019 |
| Centos_linux | — | Upgrade sudoUpgrade sudo-debuginfoUpgrade sudo-debugsourceUpgrade sudo-devel | Oct 25, 2019 | Oct 17, 2019 |
| Debian | — | Upgrade sudo | Oct 16, 2019 | Oct 16, 2019 |
| Freebsd | — | Upgrade sudo | Dec 10, 2025 | Oct 24, 2019 |
| Gentoo Linux | — | Upgrade app-admin/sudo. | Mar 16, 2020 | Oct 17, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade sudo | Dec 4, 2019 | Oct 17, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade sudo | Dec 18, 2019 | Oct 17, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade sudo | Nov 19, 2019 | Oct 17, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade sudo | Nov 28, 2019 | Oct 17, 2019 |
| Oracle Solaris | — | Upgrade security/sudo to version 1.8.28-11.4.15.0.1.4.0 on Solaris 11.4Upgrade security/sudo to version 1.8.28-0.175.3.36.0.25.0 on Solaris 11.3 | Nov 20, 2019 | Oct 17, 2019 |
| Oracle_linux | — | Upgrade sudoUpgrade sudo-devel | Nov 8, 2019 | Oct 14, 2019 |
| Redhat Openshift | — | Upgrade redhat-coreos | Dec 29, 2020 | Oct 17, 2019 |
| Redhat_linux | — | Upgrade sudo-develUpgrade sudo-debuginfoUpgrade sudo-debugsourceUpgrade sudo | Oct 25, 2019 | Oct 17, 2019 |
| Suse | — | Upgrade sudo-develUpgrade sudo-plugin-pythonUpgrade sudoUpgrade sudo-test | Oct 16, 2019 | Oct 14, 2019 |
| Ubuntu | — | Upgrade sudo (Ubuntu Pro)Upgrade sudo-ldapUpgrade sudoUpgrade sudo-ldap (Ubuntu Pro) | Oct 15, 2019 | Oct 14, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Oct 17, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub