CVE-2017-1000368

HIGH8.2EPSS 0.15%

sudo - security update

Published: 6/5/2017Modified: 4/28/2026

Description

Todd Miller's sudo version 1.8.20p1 and earlier is vulnerable to an input validation (embedded newlines) in the get_process_ttyname() function resulting in information disclosure and command execution.

Affected packages (3)

Alpine/sudofrom 0, < 1.8.20_p2-r0
Debian/sudofrom 0, < 1.8.20p1-1.1
Debian/sudofrom 0, < 1.8.5p2-1+nmu3+deb7u4

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH8.2	CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

References (2)

ADVISORYhttps://security.alpinelinux.org/vuln/CVE-2017-1000368
ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2017-1000368