Ubuntu alert USN-7867-1 (rust-sudo-rs)

From:
             
 
noreply+usn-bot@canonical.com
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-7867-1] sudo-rs vulnerabilities
Date:
             
 
Mon, 10 Nov 2025 20:57:57 +0000
Message-ID:
             
 
<E1vIYxZ-0000Es-FF@lists.ubuntu.com>
==========================================================================
Ubuntu Security Notice USN-7867-1
November 10, 2025

rust-sudo-rs vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 25.10

Summary:

Several security issues were fixed in sudo-rs.

Software Description:
- rust-sudo-rs: Rust-based sudo and su implementations

Details:

It was discovered that sudo-rs incorrectly handled passwords when timeouts
occurred and the pwfeedback default was not set. This could result in a
partially typed password being output to standard input, contrary to
expectations.

It was discovered that sudo-rs incorrectly handled the targetpw and rootpw
default settings when creating timestamp files. A local attacker could
possibly use this issue to bypass authentication in certain configurations.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 25.10
  sudo-rs                         0.2.8-1ubuntu5.2

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-7867-1
  https://launchpad.net/bugs/2130623

Package Information:
  https://launchpad.net/ubuntu/+source/rust-sudo-rs/0.2.8-1...


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmkSUcoACgkQcpJm3tlz
hgF8Ig//dKCk84BjqPgdNO2lmknvXk4EIwRr1rnAJ7SKXPjwH5mbu9RtfwR2Lb/n
t23c8NlF5+IvbX09ChS1DK35gbZCGzrGlTO4GA0wVXEz2BtKhFTkW/8WsumYh9e0
DO5u1RaECPYVBxYIgxh2y2Wqv0VEQ+xGEWu94qWK93atVzpM9Znm9q+aFDSzWHmc
usJD3sYVIKKbzjWkMctAmUSVCHXh/fD+Tg+00oIAX+VqsNsDIgcxi5JIHLr2oNbx
d5zNu5bPGe+oohRcczqHITLpIRnp9yVxC6+3nbyRJbzqcRFLUUF+Mp6pBrnD+nG1
N8l9p2ie17Ggk3uxRkH+h5evMbpnOKmG0JTvEunVRaniwQXMO3W6ZKRv14rLOB12
M5iaikSXeJlGQuo6OlX3aoUsrqP2PTQ9Mb7PWwyKmm5cY8cniQp8tKhSqvsgPMxK
WIczrE+WBYL+DqVMBHvJ/FqH1PuHuJWyUQyYWq2Q66L62JaXnQQMmYmrP1KEVifW
WR+2CjG6UDLkEF6cgN8h/fEZqYsFo5O4lzJClrd6uX146DQjjctRaKJ7Bq9jbjFw
H3Pt1YQFM8IqpTnV35UKnJrB7wO+0BQuuv+1CGrXK5uL5J0FuRaInjF/zxqXkc6T
YtIuZB7OqiNQnmHQnOcfMbKRlv9LSyFVRs9rJd/o178KlKA21/4=
=GiJa
-----END PGP SIGNATURE-----