Summary
It was discovered that sudo-rs incorrectly handled passwords when timeouts
occurred and the pwfeedback default was not set. This could result in a
partially typed password being output to standard input, contrary to
expectations.
It was discovered that sudo-rs incorrectly handled the targetpw and rootpw
default settings when creating timestamp files. A local attacker could
possibly use this issue to bypass authentication in certain configurations.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 25.10 | rust-sudo-rs | 0.2.8-1ubuntu5.2 |
References
-
report
https://launchpad.net/bugs/2130623