69
CISA Sounds Alarm on Critical Sudo Flaw Actively Exploited in Linux and Unix Systems (thehackernews.com)
submitted 1 year ago by to c/cybersecurity@sh.itjust.works
13 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 23 points 1 year ago (7 children)

The vulnerability in question is CVE-2025-32463 (CVSS score: 9.3), which affects Sudo versions prior to 1.9.17p1

Check your version: sudo --version

As mentioned above, sudo version 1.9.17p1 patches this. This version was already released in June of this year, so many distributions should have it.

  • permalink
  • fedilink
  • source
  • hideshow 7 child comments
    •
  • [–] 10 points 1 year ago (4 children)

    On Ubuntu 24.04

    Sudo version 1.9.15p5

    Eep!

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 3 points 1 year ago*

    It should be backported in supported ubuntu versions.

    sudo apt changelog sudo

    Tap for spoiler

    sudo (1.9.15p5-3ubuntu5.24.04.1) noble-security; urgency=medium

    • SECURITY UPDATE: Local Privilege Escalation via host option
      • debian/patches/CVE-2025-32462.patch: only allow specifying a host when listing privileges.
      • CVE-2025-32462
    • SECURITY UPDATE: Local Privilege Escalation via chroot option
      • debian/patches/CVE-2025-32463.patch: remove user-selected root directory chroot option.
      • CVE-2025-32463

    -- Marc Deslauriers marc.deslauriers@ubuntu.com Wed, 25 Jun 2025 08:42:53 -0400

  • permalink
  • fedilink
  • source
  • parent
  • [–] 4 points 1 year ago

    Its funny because whenever I hear about something like this with foss it tends to be this way but when its proprietary I hear on how they were informed a while back, never patched it, and the founder of the bug is now disclosing based on the timetable they gave the. Feels that way anyway.

  • permalink
  • fedilink
  • source
  • parent