CVE-2023-28487: Medium severity sudo vulnerability
Sudo before 1.9.13 does not escape control characters in sudoreplay output.
Other sources
Sudo Project Sudo could allow a remote attacker to obtain sensitive information, caused by improper escaping terminal control characters by the "sudoreplay -l" command. By sending specially crafted terminal control commands, an attacker could exploit this vulnerability to obtain restricted information information, and use this information to launch further attacks against the affected system.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID of this vulnerability is CVE-2023-28487.
What is the title of this vulnerability?
The title of this vulnerability is 'Sudo before 1.9.13 does not escape control characters in sudoreplay output.'
What is the description of this vulnerability?
The description of this vulnerability is 'Sudo before 1.9.13 does not escape control characters in sudoreplay output.'
What software is affected by this vulnerability?
The software affected by this vulnerability is Sudo Project Sudo before version 1.9.13.
What is the severity of this vulnerability?
The severity of this vulnerability is medium (5.3).
How can I fix this vulnerability?
To fix this vulnerability, update to Sudo version 1.9.13 or later.
Where can I find more information about this vulnerability?
You can find more information about this vulnerability at the following references: [Link to GitHub commit](https://github.com/sudo-project/sudo/commit/334daf92b31b79ce68ed75e2ee14fca265f029ca), [Link to GitHub release](https://github.com/sudo-project/sudo/releases/tag/SUDO_1_9_13), [Link to Gentoo advisory](https://security.gentoo.org/glsa/202309-12).
What is the Common Weakness Enumeration (CWE) ID for this vulnerability?
The Common Weakness Enumeration (CWE) ID for this vulnerability is 116.