Array Out-of-Bounds Vulnerability in Sudo by Sudo Project

CVE-2022-43995

Summary

An array-out-of-bounds error exists in Sudo versions 1.8.0 through 1.9.12 when using the crypt() password backend. This vulnerability can be exploited by any local user with Sudo access by entering a password of seven characters or fewer, leading to a potential heap-based buffer over-read. The effects of this vulnerability may vary across different system libraries, compiler configurations, and processor architectures. Organizations using affected versions should assess their configurations and apply necessary updates to mitigate risk.

References