CVE-2025-64170

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-64170", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-10-28T21:07:16.438Z", "datePublished": "2025-11-12T20:30:14.961Z", "dateUpdated": "2025-11-14T17:34:21.165Z"}, "containers": {"cna": {"title": "sudo-rs: Partial password reveal is possible after timeout", "problemTypes": [{"descriptions": [{"cweId": "CWE-549", "lang": "en", "description": "CWE-549: Missing Password Field Masking", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "PHYSICAL", "availabilityImpact": "NONE", "baseScore": 3.8, "baseSeverity": "LOW", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/trifectatechfoundation/sudo-rs/security/advisories/GHSA-c978-wq47-pvvw", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/trifectatechfoundation/sudo-rs/security/advisories/GHSA-c978-wq47-pvvw"}, {"name": "https://github.com/trifectatechfoundation/sudo-rs/releases/tag/v0.2.10", "tags": ["x_refsource_MISC"], "url": "https://github.com/trifectatechfoundation/sudo-rs/releases/tag/v0.2.10"}], "affected": [{"vendor": "trifectatechfoundation", "product": "sudo-rs", "versions": [{"version": ">= 0.2.7, < 0.2.10", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-11-12T20:30:14.961Z"}, "descriptions": [{"lang": "en", "value": "sudo-rs is a memory safe implementation of sudo and su written in Rust. Starting in version 0.2.7 and prior to version 0.2.10, if a user begins entering a password but does not press return for an extended period, a password timeout may occur. When this happens, the keystrokes that were entered are echoed back to the console. This could reveal partial password information, possibly exposing history files when not carefully handled by the user and on screen, usable for Social Engineering or Pass-By attacks. Version 0.2.10 fixes the issue."}], "source": {"advisory": "GHSA-c978-wq47-pvvw", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-14T17:34:17.406557Z", "id": "CVE-2025-64170", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-14T17:34:21.165Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-64170", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-14T17:34:17.406557Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-14T17:34:13.510Z"}}], "cna": {"title": "sudo-rs: Partial password reveal is possible after timeout", "source": {"advisory": "GHSA-c978-wq47-pvvw", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.8, "attackVector": "PHYSICAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "trifectatechfoundation", "product": "sudo-rs", "versions": [{"status": "affected", "version": ">= 0.2.7, < 0.2.10"}]}], "references": [{"url": "https://github.com/trifectatechfoundation/sudo-rs/security/advisories/GHSA-c978-wq47-pvvw", "name": "https://github.com/trifectatechfoundation/sudo-rs/security/advisories/GHSA-c978-wq47-pvvw", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/trifectatechfoundation/sudo-rs/releases/tag/v0.2.10", "name": "https://github.com/trifectatechfoundation/sudo-rs/releases/tag/v0.2.10", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "sudo-rs is a memory safe implementation of sudo and su written in Rust. Starting in version 0.2.7 and prior to version 0.2.10, if a user begins entering a password but does not press return for an extended period, a password timeout may occur. When this happens, the keystrokes that were entered are echoed back to the console. This could reveal partial password information, possibly exposing history files when not carefully handled by the user and on screen, usable for Social Engineering or Pass-By attacks. Version 0.2.10 fixes the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-549", "description": "CWE-549: Missing Password Field Masking"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-11-12T20:30:14.961Z"}}}, "cveMetadata": {"cveId": "CVE-2025-64170", "state": "PUBLISHED", "dateUpdated": "2025-11-14T17:34:21.165Z", "dateReserved": "2025-10-28T21:07:16.438Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-11-12T20:30:14.961Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "sudo-rs", "vendor": "trifectatechfoundation", "versions": [{"status": "affected", "version": ">= 0.2.7, < 0.2.10"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "sudo-rs is a memory safe implementation of sudo and su written in Rust. Starting in version 0.2.7 and prior to version 0.2.10, if a user begins entering a password but does not press return for an extended period, a password timeout may occur. When this happens, the keystrokes that were entered are echoed back to the console. This could reveal partial password information, possibly exposing history files when not carefully handled by the user and on screen, usable for Social Engineering or Pass-By attacks. Version 0.2.10 fixes the issue."}, {"lang": "es", "value": "sudo-rs es una implementaci\u00f3n de sudo y su segura para la memoria escrita en Rust. A partir de la versi\u00f3n 0.2.7 y antes de la versi\u00f3n 0.2.10, si un usuario comienza a introducir una contrase\u00f1a pero no presiona 'enter' durante un per\u00edodo prolongado, puede producirse un tiempo de espera de la contrase\u00f1a. Cuando esto sucede, las pulsaciones de teclas que se introdujeron se hacen eco en la consola. Esto podr\u00eda revelar informaci\u00f3n parcial de la contrase\u00f1a, posiblemente exponiendo archivos de historial cuando no se maneja con cuidado por parte del usuario y en pantalla, utilizable para ataques de ingenier\u00eda social o Pass-By. La versi\u00f3n 0.2.10 corrige el problema."}], "id": "CVE-2025-64170", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "PHYSICAL", "availabilityImpact": "NONE", "baseScore": 3.8, "baseSeverity": "LOW", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 0.1, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-64170", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-14T17:34:17.406557Z", "version": "2.0.3"}}]}, "published": "2025-11-12T21:15:53.433", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/trifectatechfoundation/sudo-rs/releases/tag/v0.2.10"}, {"source": "security-advisories@github.com", "url": "https://github.com/trifectatechfoundation/sudo-rs/security/advisories/GHSA-c978-wq47-pvvw"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-549"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"created": "2025-11-14T09:29:16.478869+00:00", "updated": "2025-11-14T09:29:16.478895+00:00", "vendors": ["sudo-rs", "sudo-rs$PRODUCT$sudo-rs"]}