Your submission was sent successfully! Close

You have successfully unsubscribed! Close

CVE-2023-28487

Published: 16 March 2023

Sudo before 1.9.13 does not escape control characters in sudoreplay output.

Notes

AuthorNote
mdeslaur
same commit as CVE-2023-28486

Priority

Medium

Cvss 3 Severity Score

5.3

Score breakdown

Status

Package Release Status
sudo
Launchpad, Ubuntu, Debian
bionic Needed

focal Needed

jammy Needed

kinetic Needed

trusty Needed

upstream Needs triage

xenial Needed

Patches:
upstream: https://github.com/sudo-project/sudo/commit/334daf92b31b79ce68ed75e2ee14fca265f029ca

Severity score breakdown

Parameter Value
Base score 5.3
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Scope Unchanged
Confidentiality Low
Integrity impact None
Availability impact None
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N