CVE-2023-28486: Medium severity sudo vulnerability
Sudo before 1.9.13 does not escape control characters in log messages.
Other sources
Sudo Project Sudo could allow a remote attacker to obtain sensitive information, caused by improper escaping terminal control characters during logging operations. By sending specially crafted terminal control commands, an attacker could exploit this vulnerability to obtain restricted information information, and use this information to launch further attacks against the affected system.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID of this vulnerability is CVE-2023-28486.
What is the title of this vulnerability?
The title of this vulnerability is "Sudo before 1.9.13 does not escape control characters in log messages."
How does the vulnerability affect the software?
The vulnerability affects Sudo before version 1.9.13.
What is the severity of CVE-2023-28486?
The severity of CVE-2023-28486 is medium with a CVSS score of 5.3.
How can I fix the CVE-2023-28486 vulnerability?
To fix the CVE-2023-28486 vulnerability, you should update Sudo to version 1.9.13 or later.