REDHAT-BUG-2374693: High severity Sudo Sudo vulnerability
Published Jun 24, 2025
·Updated
An attacker can leverage sudo's -R (--chroot) option to run arbitrary commands as root, even if they are not listed in the sudoers file. Sudo versions 1.9.14 to 1.9.17 inclusive are affected.
Affected Software
1 affected component
Sudo Sudo>=1.9.14<=1.9.17
Event History
Jun 24, 2025
Data Sourced
via Red Hat·09:27 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the severity of REDHAT-BUG-2374693?
The severity of REDHAT-BUG-2374693 is high due to the potential for attackers to execute arbitrary commands as root.
2
How do I fix REDHAT-BUG-2374693?
To fix REDHAT-BUG-2374693, upgrade sudo to version 1.9.18 or later.
3
Which versions of sudo are affected by REDHAT-BUG-2374693?
Sudo versions 1.9.14 to 1.9.17 inclusive are affected by REDHAT-BUG-2374693.
4
Can users not in the sudoers file exploit REDHAT-BUG-2374693?
Yes, users not listed in the sudoers file can exploit REDHAT-BUG-2374693 to execute arbitrary commands as root.
5
What functionality does the `-R` option in sudo relate to REDHAT-BUG-2374693?
The `-R` (or `--chroot`) option in sudo is exploited in REDHAT-BUG-2374693 to run commands as root without proper permissions.