Description
A flaw was found in sudo in the handling of ipa_hostname, where ipa_hostname from /etc/sssd/sssd.conf was not propagated in sudo. Therefore, it leads to privilege mismanagement vulnerability in applications, where client hosts retain privileges even after retracting them.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | sudo | — | 1.8.28 |
| Red Hat | Red Hat Enterprise Linux 6 | — | — |
| Red Hat | Red Hat Enterprise Linux 7 | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Fedora | Fedora | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | sudo | 1.8.28p1-1 | — |
| Debian 13 | sudo | 1.8.28p1-1 | — |
| Debian 12 | sudo | 1.8.28p1-1 | — |
| Debian 10 | sudo | 1.8.27-1+deb10u6 | DLA-3732-1 |
Advisories 2
- DLA-3732-1 sudo - security update Debian Security (DSA / DLA) · Mar 9, 2026
- WID-SEC-2023-3216 sudo: Schwachstelle ermöglicht Privilegieneskalation BSI CERT-Bund (WID) · Feb 7, 2024