CISA adds critical Sudo flaw CVE-2025-32463 and four other exploited vulnerabilities to KEV list.
  • Einar@lemmy.zipEnglish
    22·
    2 days ago

    The vulnerability in question is CVE-2025-32463 (CVSS score: 9.3), which affects Sudo versions prior to 1.9.17p1

    Check your version: sudo --version

    As mentioned above, sudo version 1.9.17p1 patches this. This version was already released in June of this year, so many distributions should have it.

    • SayCyberOnceMore@feddit.ukEnglish
      2·
      2 days ago

      Thanks for posting the version.

      Looks like Arch updated to this version on 1st July.

      My DMZ node had it installed a week later, so I’m all smug today

    • HubertManne@piefed.socialEnglish
      41·
      2 days ago

      Its funny because whenever I hear about something like this with foss it tends to be this way but when its proprietary I hear on how they were informed a while back, never patched it, and the founder of the bug is now disclosing based on the timetable they gave the. Feels that way anyway.

  • CubitOom@infosec.pubEnglish
    23·
    2 days ago

    This vulnerability could allow a local attacker to leverage sudo’s -R (–chroot) option to run arbitrary commands as root, even if they are not listed in the sudoers file.