Skip to content
OpenAdvisories
High 1 exploited CVE ALAS2023-2025-1070 2 CVEs

Important: sudo security update (Amazon Linux 2023)

Published Jul 3, 2025 · Updated Jul 10, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-32463: Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option. CVE-2025-32462: Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL, allows listed users to execute commands on unintended machines.

Fixed packages 8

ReleasePackageFixed in
Amazon Linux · 2023 sudo 0:1.9.15-1.p5.amzn2023.0.2
Amazon Linux · 2023 sudo-debuginfo 0:1.9.15-1.p5.amzn2023.0.2
Amazon Linux · 2023 sudo-debugsource 0:1.9.15-1.p5.amzn2023.0.2
Amazon Linux · 2023 sudo-devel 0:1.9.15-1.p5.amzn2023.0.2
Amazon Linux · 2023 sudo-logsrvd 0:1.9.15-1.p5.amzn2023.0.2
Amazon Linux · 2023 sudo-logsrvd-debuginfo 0:1.9.15-1.p5.amzn2023.0.2
Amazon Linux · 2023 sudo-python-plugin 0:1.9.15-1.p5.amzn2023.0.2
Amazon Linux · 2023 sudo-python-plugin-debuginfo 0:1.9.15-1.p5.amzn2023.0.2

Vulnerabilities 2

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-32462.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-32463.html