PT-2025-20703 · Sudo-Rs · Sudo-Rs

Squell · Published 2025-05-12 · Updated 2025-05-13 · CVE-2025-46717

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions sudo-rs versions prior to 0.2.6

Description The issue allows users with limited or no sudo privileges to determine the existence of files in folders they cannot access using the sudo --list <pathname> command. This can reveal sensitive information in file names and potentially be used in conjunction with other attacks.

Recommendations For versions prior to 0.2.6, update to version 0.2.6 to resolve the issue. As a temporary workaround, consider restricting access to the sudo --list command to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-497

Related Identifiers

CVE-2025-46717

GHSA-98CV-WQJX-WX8F

Affected Products

Sudo-Rs

References · 17

• 🔥 https://github.com/trifectatechfoundation/sudo-rs/security/advisories/GHSA-98cv-wqjx-wx8f · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/46xxx/CVE-2025-46717.json · Exploit
• https://osv.dev/vulnerability/GHSA-98cv-wqjx-wx8f · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-46717 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-46717 · Security Note
• https://osv.dev/vulnerability/CVE-2025-46717 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-46717 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-46717 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-46717 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-46717 · Security Note
• https://github.com/trifectatechfoundation/sudo-rs · Note
• https://github.com/trifectatechfoundation/sudo-rs/releases/tag/v0.2.6 · Note
• https://github.com/trifectatechfoundation/sudo-rs/commit/54984189d62a0763235d4a02a4b2d09d768a9986 · Note
• https://github.com/trifectatechfoundation/sudo-rs/commit/848719f28067d3b5e6672d07f34da5b24f85765b · Note
• https://t.me/cvedetector/25084 · Telegram Post