PT-2025-20704 · Sudo-Rs · Sudo-Rs

Zonia3000 · Published 2025-05-12 · Updated 2025-07-11 · CVE-2025-46718

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions sudo-rs versions prior to 0.2.6

Description The issue allows users with limited sudo privileges to enumerate the sudoers file, revealing sensitive information about other users' permissions. This can be achieved using the -U flag. Attackers can collect information that can be used for more targeted attacks. Systems where users either do not have sudo privileges or have the ability to run all commands as root through sudo are not affected.

Recommendations For versions prior to 0.2.6, update to version 0.2.6 to resolve the issue. As a temporary workaround, consider restricting the use of the -U flag to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-497

Related Identifiers

CVE-2025-46718

GHSA-W9Q3-G4P5-5Q2R

Affected Products

Sudo-Rs

References · 18

• 🔥 https://github.com/trifectatechfoundation/sudo-rs/security/advisories/GHSA-w9q3-g4p5-5q2r · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/46xxx/CVE-2025-46718.json · Exploit
• https://ubuntu.com/security/CVE-2025-46718 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-46718 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-46718 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-46718 · Security Note
• https://osv.dev/vulnerability/GHSA-w9q3-g4p5-5q2r · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-46718 · Security Note
• https://osv.dev/vulnerability/CVE-2025-46718 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-46718 · Vendor Advisory
• https://github.com/trifectatechfoundation/sudo-rs · Note
• https://github.com/trifectatechfoundation/sudo-rs/releases/tag/v0.2.6 · Note
• https://github.com/trifectatechfoundation/sudo-rs/commit/54984189d62a0763235d4a02a4b2d09d768a9986 · Note
• https://github.com/trifectatechfoundation/sudo-rs/commit/848719f28067d3b5e6672d07f34da5b24f85765b · Note
• https://twitter.com/boxswapper/status/1943715222482825709 · Twitter Post