Summary
[1.9.17-7]
- CVE-2026-96512 sudo: sudo: TZ environment variable allows bypass of
NOTBEFORE/NOTAFTER time-based authorization [rhel-10.2.z]
[1.9.17-6]
- Fix CVE-2026-82474: execveat(2) intercept/log_subcmds bypass
[1.9.17-5.p2]
- Resolves: RHEL-212546 - Use canonicalized path if user path contains '..'
[1.9.17-4.p2]
- Bump release number
- Resolves: RHEL-164620 - CVE-2026-35535 sudo: Sudo: Privilege escalation
due to failure in privilege drop calls
[1.9.17-3.p2]
- Resolves: RHEL-164620 - CVE-2026-35535 sudo: Sudo: Privilege escalation
due to failure in privilege drop calls
[1.9.17-2.p2]
- Resolves: RHEL-59136 - sudo passes SHELL environment variable twice to
the shell being executed [rhel-10]
- Resolves: RHEL-128212 - [RFE] request to backport support for regex in
sudo [rhel-10]
- Resolves: RHEL-112100 - Rebase of sudo to 1.9.17p2 [rhel-10]
[1.9.17-1.p2]
- Rebase sudo to 1.9.17p2
- Resolves: RHEL-122752
[1.9.15-9.p5]
- RHEL 10.1 ERRATUM
- CVE-2025-32462 sudo: LPE via host option Resolves: RHEL-100009
- CVE-2025-32463 sudo: LPE via chroot option Resolves: RHEL-100022
[1.9.15-8.p5]
- Bump release for October 2024 mass rebuild:
[1.9.15-7.p5]
- RHEL 10.0 ERRATUM
- sudo-1.9.15-2.p5.el10: RHEL SAST Automation: address 4 High impact true
positive(s) Resolves: RHEL-44436
- sudo subpackage sudo-logsrvd should not be built Resolves: RHEL-52864
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 10 | sudo | 0:1.9.17-10.p2.el10_2.7 |
| Oracle Linux · 10 | sudo-python-plugin | 0:1.9.17-10.p2.el10_2.7 |
Vulnerabilities 1
-
High 7.8CVE-2026-96512 Public exploit
Sudo: sudo: tz environment variable allows bypass of notbefore/notafter time-based authorization
A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Bec…