{"id":"GHSA-c978-wq47-pvvw","revision":"1286f921d7f9449f8317c757352abd63","records":[{"revision":"1286f921d7f9449f8317c757352abd63","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"GHSA-c978-wq47-pvvw","aliases":["CVE-2025-64170"],"title":"sudo-rs: Partial password reveal is possible after timeout","description":"### Summary\nIf a user begins entering a password but does not press return for an extended period, a password timeout may occur. When this happens, the keystrokes that were entered are echoed back to the console.\n\n### Example\nUsing sudo-rs:\n```\ngeiger@cerberus:~$ sudo -s\n[sudo: authenticate] Password: sudo-rs: timed out\ngeiger@cerberus:~$ testtesttest\n```\n\n\"testtesttest\" was entered at the password prompt but not confirmed by pressing return and then waiting for the timeout.\n\n### Impact\nThis could reveal partial password information, possibly exposing history files when not carefully handled by the user and on screen, usable for Social Engineering or Pass-By attacks.\n\n### Versions affected\nPasswords timeouts were added in sudo-rs 0.2.7 (with a default set to 5 minutes).\n\n### Credits\nThis issue was discovered and reported by @DevLaTron.","state":0,"publishedAt":"2025-11-12T21:30:11+00:00","modifiedAt":"2025-11-15T03:13:07+00:00","affected":[{"ecosystem":"crates.io","name":"sudo-rs","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.2.7"},{"kind":"fixed","version":"0.2.10"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"LOW"}],"references":["https://github.com/trifectatechfoundation/sudo-rs/security/advisories/GHSA-c978-wq47-pvvw","https://nvd.nist.gov/vuln/detail/CVE-2025-64170","https://github.com/trifectatechfoundation/sudo-rs/commit/0e3d3837aec3ee9fb5dcb8bfe11e8adb367f58f4","https://github.com/trifectatechfoundation/sudo-rs","https://github.com/trifectatechfoundation/sudo-rs/releases/tag/v0.2.10"],"sourceUrl":"https://github.com/advisories/GHSA-c978-wq47-pvvw","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-c978-wq47-pvvw","identifiers":["GHSA-c978-wq47-pvvw","CVE-2025-64170"]},"retained":false,"historicalAffected":[]}],"coverage":[]}