Skip to content
OpenAdvisories
Unscored USN-7867-1 0 CVEs

rust-sudo-rs vulnerabilities

Published Nov 10, 2025 · Updated Feb 10, 2026

Summary

It was discovered that sudo-rs incorrectly handled passwords when timeouts
occurred and the pwfeedback default was not set. This could result in a
partially typed password being output to standard input, contrary to
expectations.

It was discovered that sudo-rs incorrectly handled the targetpw and rootpw
default settings when creating timestamp files. A local attacker could
possibly use this issue to bypass authentication in certain configurations.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 25.10 rust-sudo-rs 0.2.8-1ubuntu5.2

References

  • report
    https://launchpad.net/bugs/2130623