Authentication Bypass Vulnerability in sudo-rs by Trifecta Tech Foundation
CVE-2025-64517

4.4MEDIUM

Key Information:

Vendor

Trifectatechfoundation

Status
Sudo-rs
Vendor
CVE Published:
12 November 2025

What is CVE-2025-64517?

The sudo-rs software, a secure implementation of the sudo command, contains a vulnerability that affects its functionality related to user authentication. When the Defaults targetpw or Defaults rootpw settings are enabled, the system improperly records the invoking user's UID instead of the target user's UID in the authentication timestamp. This flaw allows a highly-privileged user to execute commands on behalf of other accounts without knowing their passwords, effectively circumventing intended security policies. Users running versions 0.2.5 to 0.2.9 of sudo-rs are at risk, with the issue resolved in version 0.2.10.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

sudo-rs >= 0.2.5, < 0.2.10

References

https://github.com/trifectatechfoundation/sudo-rs/securit...
x_refsource_CONFIRM
https://github.com/trifectatechfoundation/sudo-rs/release...
x_refsource_MISC

CVSS V3.1

Score:
4.4
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.