Security issues discovered in sudo-rs
lists.debian.org
Security issues discovered in sudo-rs
1–10 of 18 posts
Re: Security issues discovered in sudo-rs
#2To save everyone a click, the text is:
""" Two security issues were discovered in sudo-rs, a Rust-based implemention of sudo (and su), which could result in the local disclosure of partially typed passwords or an authentication bypass in some targetpw/rootpw configurations.
For the stable distribution (trixie), this problem has been fixed in version 0.2.5-5+deb13u1.
We recommend that you upgrade your rust-sudo-rs packages. """
Re: Security issues discovered in sudo-rs
#3as far as i can see, it's just programming errors, nothing to do with rust.
Re: Security issues discovered in sudo-rs
#4What were the actual fixes like?
Re: Security issues discovered in sudo-rs
#5as far as i can see, it's just programming errors, nothing to do with rust.
Everything to do with reimplementing sudo, though.
But sudo has its share of CVEs as well (latest CVE-2025-32463), so perhaps a fresh look on the tool is warranted; perhaps some learnings have been taken from it.
Re: Security issues discovered in sudo-rs
#6[deleted]
Re: Security issues discovered in sudo-rs
#7[deleted]
Re: Security issues discovered in sudo-rs
#8as far as i can see, it's just programming errors, nothing to do with rust.
Everything to do with reimplementing sudo, though. But sudo has its share of CVEs as well (latest CVE-2025-32463), so perhaps a fresh look on the tool is warranted; perhaps some learnings have been taken from it.
I think if rust was used to replace other bits (say things like utilities like grep or whatever) instead of security vital things like sudo, there would be less complaints.
Re: Security issues discovered in sudo-rs
#9What were the actual fixes like?
There is a link to github commit in the "Notes" section for each CVE [1].
[1]: https://security-tracker.debian.org/tracker/source-package/r...
Re: Security issues discovered in sudo-rs
#10as far as i can see, it's just programming errors, nothing to do with rust.
Everything to do with reimplementing sudo, though. But sudo has its share of CVEs as well (latest CVE-2025-32463), so perhaps a fresh look on the tool is warranted; perhaps some learnings have been taken from it.
A fresh look would be perhaps doas [1] from the OpenBSD project.