Your submission was sent successfully! Close

You have successfully unsubscribed! Close

CVE-2023-28487

Published: 16 March 2023

Sudo before 1.9.13 does not escape control characters in sudoreplay output.

Notes

AuthorNote
mdeslaur
same commit as CVE-2023-28486

Priority

Medium

Cvss 3 Severity Score

5.3

Score breakdown

Status

Package Release Status
sudo
Launchpad, Ubuntu, Debian
upstream Needs triage

trusty Needed

xenial
Released (1.8.16-0ubuntu1.10+esm2)
Available with Ubuntu Pro or Ubuntu Pro (Infra-only)
bionic
Released (1.8.21p2-3ubuntu1.6)
focal
Released (1.8.31-1ubuntu1.5)
jammy
Released (1.9.9-1ubuntu2.4)
kinetic
Released (1.9.11p3-1ubuntu1.3)
lunar
Released (1.9.13p1-1ubuntu2)
Patches:
upstream: https://github.com/sudo-project/sudo/commit/334daf92b31b79ce68ed75e2ee14fca265f029ca

Severity score breakdown

Parameter Value
Base score 5.3
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Scope Unchanged
Confidentiality Low
Integrity impact None
Availability impact None
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N