p PatchFirst

CVE-2017-1000368

CVE-2017-1000368

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Todd Miller's sudo version 1.8.20p1 and earlier is vulnerable to an input validation (embedded newlines) in the get_process_ttyname() function resulting in information disclosure and command execution.

CVSS 8.2 · High · EPSS 0.6% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • sudo Debian:12

    Affected ranges
    • ECOSYSTEM: < 1.8.20p1-1.1

    Update to 1.8.20p1-1.1

  • sudo Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.8.20p1-1.1

    Update to 1.8.20p1-1.1

  • sudo Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.8.20p1-1.1

    Update to 1.8.20p1-1.1

  • sudo Ubuntu:Pro:14.04:LTS

    Versions
    • 1.8.6p3-0ubuntu3
    • 1.8.8-2ubuntu1
    • 1.8.8-2ubuntu2
    • 1.8.9p4-1ubuntu1
    • 1.8.9p4-1ubuntu2
    • 1.8.9p5-1ubuntu1
    • 1.8.9p5-1ubuntu1.1
    • 1.8.9p5-1ubuntu1.2
    • 1.8.9p5-1ubuntu1.3
    • 1.8.9p5-1ubuntu1.4
    Affected ranges
    • ECOSYSTEM: < 1.8.9p5-1ubuntu1.5+esm1

    Update to 1.8.9p5-1ubuntu1.5+esm1

  • sudo Ubuntu:16.04:LTS

    Versions
    • 1.8.12-1ubuntu3
    • 1.8.16-0ubuntu1
    • 1.8.16-0ubuntu1.1
    • 1.8.16-0ubuntu1.2
    • 1.8.16-0ubuntu1.3
    • 1.8.16-0ubuntu1.4
    • 1.8.16-0ubuntu1.5
    Affected ranges
    • ECOSYSTEM: < 1.8.16-0ubuntu1.6

    Update to 1.8.16-0ubuntu1.6

  • sudo Ubuntu:18.04:LTS

    Affected ranges
    • ECOSYSTEM: < 1.8.20p2-1ubuntu1

    Update to 1.8.20p2-1ubuntu1

Original sources

Check your server →