Description
The secure path feature in env.c in sudo 1.3.1 through 1.6.9p22 and 1.7.0 through 1.7.2p6 does not properly handle an environment that contains multiple PATH variables, which might allow local users to gain privileges via a crafted value of the last PATH variable.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | sudo | 1.7.2p7-1 | — |
| Debian 13 | sudo | 1.7.2p7-1 | — |
| Debian 12 | sudo | 1.7.2p7-1 | — |
| Debian 5.0 | sudo | 1.6.9p17-3 | DSA-2062-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | sudo | 1.7.2p1-7.el5_5 | RHSA-2010:0475 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | sudo | 1.8.18p1-1.1 | openSUSE-SU-2024:10551-1 |
Advisories 3
- RHSA-2010:0475 Red Hat Security Advisory: sudo security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2062-1 sudo - environment sanitization bypass Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10551-1 sudo-1.8.18p1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 65083 vdb-entry
- FEDORA-2010-9417 vendor-advisory
- 43068 third-party-advisory
- http://www.sudo.ws/sudo/alerts/secure_path.html
- http://www.sudo.ws/repos/sudo/rev/3057fde43cf0
- oval:org.mitre.oval:def:10580 vdb-entry signature
- MDVSA-2010:118 vendor-advisory
- ADV-2011-0212 vdb-entry
- 40188 third-party-advisory
- 40002 third-party-advisory
- 40215 third-party-advisory
- 20101027 rPSA-2010-0075-1 sudo mailing-list
- 1024101 vdb-entry
- 40538 vdb-entry
- FEDORA-2010-9415 vendor-advisory
- http://www.sudo.ws/repos/sudo/rev/a09c6812eaec
- SUSE-SR:2011:002 vendor-advisory
- DSA-2062 vendor-advisory
- FEDORA-2010-9402 vendor-advisory
- http://wiki.rpath.com/Advisories:rPSA-2010-0075
- GLSA-201009-03 vendor-advisory
- ADV-2010-1478 vdb-entry
- RHSA-2010:0475 vendor-advisory
- oval:org.mitre.oval:def:7338 vdb-entry signature
- 40508 third-party-advisory
- ADV-2010-1518 vdb-entry
- ADV-2010-1519 vdb-entry
- ADV-2010-1452 vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=598154