Summary
USN-8895-1 fixed a vulnerability in Sudo. This update provides the
corresponding updates for Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.
Original advisory details:
It was discovered that Sudo did not properly handle time-based access
restrictions when sudoers rules used NOTBEFORE or NOTAFTER with
timestamps omitting the trailing timezone indicator. A local attacker
could possibly use this issue to execute commands outside the intended
time window by manipulating the TZ environment variable.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | sudo | 1.8.21p2-3ubuntu1.6+esm2 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | sudo | 1.8.31-1ubuntu1.5+esm2 |
Vulnerabilities 1
-
High 7.8CVE-2026-96512 Public exploit
Sudo: sudo: tz environment variable allows bypass of notbefore/notafter time-based authorization
A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Bec…
References
-
report
https://ubuntu.com/security/CVE-2026-96512