Description
sudo 1.6.8 and other versions does not clear the PYTHONINSPECT environment variable, which allows limited local users to gain privileges via a Python script, a variant of CVE-2005-4158.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗Advisories 1
- DSA-946-2 sudo - missing input sanitising Debian Security (DSA / DLA) · Mar 9, 2026
References
- 2006-0010 vendor-advisory
- 18549 third-party-advisory
- 18558 third-party-advisory
- SSA:2006-045-08 vendor-advisory
- 18363 third-party-advisory
- SUSE-SR:2006:002 vendor-advisory
- 18358 third-party-advisory
- 16184 vdb-entry
- 19016 third-party-advisory
- 18906 third-party-advisory
- DSA-946 vendor-advisory
- MDKSA-2006:159 vendor-advisory
- USN-235-2 vendor-advisory
- 21692 third-party-advisory