{"id":"CVE-2025-64517","sourceIdentifier":"security-advisories@github.com","published":"2025-11-12T22:15:50.460","lastModified":"2026-10-18T20:10:00.110","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"sudo-rs is a memory safe implementation of sudo and su written in Rust. With `Defaults targetpw` (or `Defaults rootpw`) enabled,  the password of the target account (or root account) instead of the invoking user is used for authentication. sudo-rs starting in version 0.2.5 and prior to version 0.2.10 incorrectly recorded the invoking user’s UID instead of the authenticated-as user's UID in the authentication timestamp. Any later `sudo` invocation on the same terminal while the timestamp was still valid would use that timestamp, potentially bypassing new authentication even if the policy would have required it. A highly-privileged user (able to run commands as other users, or as root, through sudo) who knows one password of an account they are allowed to run commands as, would be able to run commands as any other account the policy permits them to run commands for, even if they don't know the password for those accounts. A common instance of this would be that a user can still use their own password to run commands as root (the default behaviour of `sudo`), effectively negating the intended behaviour of the `targetpw` or `rootpw` options. Version 0.2.10 contains a patch for the issue. Versions prior to 0.2.5 are not affected, since they do not offer `Defaults targetpw` or `Defaults rootpw`."},{"lang":"es","value":"sudo-rs es una implementación segura en memoria de sudo y su escrita en Rust. Con 'Defaults targetpw' (o 'Defaults rootpw') habilitado, la contraseña de la cuenta de destino (o cuenta root) en lugar de la del usuario invocador se utiliza para la autenticación. sudo-rs a partir de la versión 0.2.5 y versiones anteriores a la versión 0.2.10 registraba incorrectamente el UID del usuario invocador en lugar del UID del usuario autenticado en la marca de tiempo de autenticación. Cualquier invocación posterior de 'sudo' en la misma terminal mientras la marca de tiempo seguía siendo válida usaría esa marca de tiempo, potencialmente eludiendo una nueva autenticación incluso si la política lo hubiera requerido. Un usuario con altos privilegios (capaz de ejecutar comandos como otros usuarios, o como root, a través de sudo) que conozca una contraseña de una cuenta como la que se le permite ejecutar comandos, podría ejecutar comandos como cualquier otra cuenta para la que la política les permita ejecutar comandos, incluso si no conocen la contraseña de esas cuentas. Un caso común de esto sería que un usuario aún puede usar su propia contraseña para ejecutar comandos como root (el comportamiento predeterminado de 'sudo'), negando efectivamente el comportamiento previsto de las opciones 'targetpw' o 'rootpw'. La versión 0.2.10 contiene un parche para el problema. Versiones anteriores a la 0.2.5 no se ven afectadas, ya que no ofrecen 'Defaults targetpw' o 'Defaults rootpw'."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"trifectatechfoundation","product":"sudo-rs","versions":[{"version":">= 0.2.5, < 0.2.10","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","baseScore":4.4,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":0.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-11-13T15:39:22.823390Z","id":"CVE-2025-64517","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://github.com/trifectatechfoundation/sudo-rs/commit/8423fd986c3fa58b357f238c0db5e54baca5255d.","source":"security-advisories@github.com"},{"url":"https://github.com/trifectatechfoundation/sudo-rs/releases/tag/v0.2.10","source":"security-advisories@github.com"},{"url":"https://github.com/trifectatechfoundation/sudo-rs/security/advisories/GHSA-q428-6v73-fc4q","source":"security-advisories@github.com"}]}