p PatchFirst

CVE-2022-43995

CVE-2022-43995

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Sudo 1.8.0 through 1.9.12, with the crypt() password backend, contains a plugins/sudoers/auth/passwd.c array-out-of-bounds error that can result in a heap-based buffer over-read. This can be triggered by arbitrary local users with access to Sudo by entering a password of seven characters or fewer. The impact could vary depending on the system libraries, compiler, and processor architecture.

CVSS 7.1 · High · EPSS 0.3% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • sudo Debian:12

    Affected ranges
    • ECOSYSTEM: < 1.9.12p1-1

    Update to 1.9.12p1-1

  • sudo Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.9.12p1-1

    Update to 1.9.12p1-1

  • sudo Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.9.12p1-1

    Update to 1.9.12p1-1

Original sources

Check your server →