CVE-2025-64517

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-64517", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-11-05T21:15:39.400Z", "datePublished": "2025-11-12T22:08:29.422Z", "dateUpdated": "2026-02-12T15:49:17.021Z"}, "containers": {"cna": {"title": "sudo-rs doesn't record authenticating user properly in timestamp", "problemTypes": [{"descriptions": [{"cweId": "CWE-287", "lang": "en", "description": "CWE-287: Improper Authentication", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/trifectatechfoundation/sudo-rs/security/advisories/GHSA-q428-6v73-fc4q", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/trifectatechfoundation/sudo-rs/security/advisories/GHSA-q428-6v73-fc4q"}, {"name": "https://github.com/trifectatechfoundation/sudo-rs/commit/8423fd986c3fa58b357f238c0db5e54baca5255d.", "tags": ["x_refsource_MISC"], "url": "https://github.com/trifectatechfoundation/sudo-rs/commit/8423fd986c3fa58b357f238c0db5e54baca5255d."}, {"name": "https://github.com/trifectatechfoundation/sudo-rs/releases/tag/v0.2.10", "tags": ["x_refsource_MISC"], "url": "https://github.com/trifectatechfoundation/sudo-rs/releases/tag/v0.2.10"}], "affected": [{"vendor": "trifectatechfoundation", "product": "sudo-rs", "versions": [{"version": ">= 0.2.5, < 0.2.10", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-09T15:37:30.592Z"}, "descriptions": [{"lang": "en", "value": "sudo-rs is a memory safe implementation of sudo and su written in Rust. With `Defaults targetpw` (or `Defaults rootpw`) enabled, the password of the target account (or root account) instead of the invoking user is used for authentication. sudo-rs starting in version 0.2.5 and prior to version 0.2.10 incorrectly recorded the invoking user\u2019s UID instead of the authenticated-as user's UID in the authentication timestamp. Any later `sudo` invocation on the same terminal while the timestamp was still valid would use that timestamp, potentially bypassing new authentication even if the policy would have required it. A highly-privileged user (able to run commands as other users, or as root, through sudo) who knows one password of an account they are allowed to run commands as, would be able to run commands as any other account the policy permits them to run commands for, even if they don't know the password for those accounts. A common instance of this would be that a user can still use their own password to run commands as root (the default behaviour of `sudo`), effectively negating the intended behaviour of the `targetpw` or `rootpw` options. Version 0.2.10 contains a patch for the issue. Versions prior to 0.2.5 are not affected, since they do not offer `Defaults targetpw` or `Defaults rootpw`."}], "source": {"advisory": "GHSA-q428-6v73-fc4q", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-13T15:39:22.823390Z", "id": "CVE-2025-64517", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-12T15:49:17.021Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-64517", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-13T15:39:22.823390Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-13T15:40:10.975Z"}}], "cna": {"title": "sudo-rs doesn't record authenticating user properly in timestamp", "source": {"advisory": "GHSA-q428-6v73-fc4q", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "trifectatechfoundation", "product": "sudo-rs", "versions": [{"status": "affected", "version": ">= 0.2.5, < 0.2.10"}]}], "references": [{"url": "https://github.com/trifectatechfoundation/sudo-rs/security/advisories/GHSA-q428-6v73-fc4q", "name": "https://github.com/trifectatechfoundation/sudo-rs/security/advisories/GHSA-q428-6v73-fc4q", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/trifectatechfoundation/sudo-rs/commit/8423fd986c3fa58b357f238c0db5e54baca5255d.", "name": "https://github.com/trifectatechfoundation/sudo-rs/commit/8423fd986c3fa58b357f238c0db5e54baca5255d.", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/trifectatechfoundation/sudo-rs/releases/tag/v0.2.10", "name": "https://github.com/trifectatechfoundation/sudo-rs/releases/tag/v0.2.10", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "sudo-rs is a memory safe implementation of sudo and su written in Rust. With `Defaults targetpw` (or `Defaults rootpw`) enabled, the password of the target account (or root account) instead of the invoking user is used for authentication. sudo-rs starting in version 0.2.5 and prior to version 0.2.10 incorrectly recorded the invoking user\u2019s UID instead of the authenticated-as user's UID in the authentication timestamp. Any later `sudo` invocation on the same terminal while the timestamp was still valid would use that timestamp, potentially bypassing new authentication even if the policy would have required it. A highly-privileged user (able to run commands as other users, or as root, through sudo) who knows one password of an account they are allowed to run commands as, would be able to run commands as any other account the policy permits them to run commands for, even if they don't know the password for those accounts. A common instance of this would be that a user can still use their own password to run commands as root (the default behaviour of `sudo`), effectively negating the intended behaviour of the `targetpw` or `rootpw` options. Version 0.2.10 contains a patch for the issue. Versions prior to 0.2.5 are not affected, since they do not offer `Defaults targetpw` or `Defaults rootpw`."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287: Improper Authentication"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-09T15:37:30.592Z"}}}, "cveMetadata": {"cveId": "CVE-2025-64517", "state": "PUBLISHED", "dateUpdated": "2026-02-12T15:49:17.021Z", "dateReserved": "2025-11-05T21:15:39.400Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-11-12T22:08:29.422Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "sudo-rs", "vendor": "trifectatechfoundation", "versions": [{"status": "affected", "version": ">= 0.2.5, < 0.2.10"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "sudo-rs is a memory safe implementation of sudo and su written in Rust. With `Defaults targetpw` (or `Defaults rootpw`) enabled, the password of the target account (or root account) instead of the invoking user is used for authentication. sudo-rs starting in version 0.2.5 and prior to version 0.2.10 incorrectly recorded the invoking user\u2019s UID instead of the authenticated-as user's UID in the authentication timestamp. Any later `sudo` invocation on the same terminal while the timestamp was still valid would use that timestamp, potentially bypassing new authentication even if the policy would have required it. A highly-privileged user (able to run commands as other users, or as root, through sudo) who knows one password of an account they are allowed to run commands as, would be able to run commands as any other account the policy permits them to run commands for, even if they don't know the password for those accounts. A common instance of this would be that a user can still use their own password to run commands as root (the default behaviour of `sudo`), effectively negating the intended behaviour of the `targetpw` or `rootpw` options. Version 0.2.10 contains a patch for the issue. Versions prior to 0.2.5 are not affected, since they do not offer `Defaults targetpw` or `Defaults rootpw`."}, {"lang": "es", "value": "sudo-rs es una implementaci\u00f3n segura en memoria de sudo y su escrita en Rust. Con 'Defaults targetpw' (o 'Defaults rootpw') habilitado, la contrase\u00f1a de la cuenta de destino (o cuenta root) en lugar de la del usuario invocador se utiliza para la autenticaci\u00f3n. sudo-rs a partir de la versi\u00f3n 0.2.5 y versiones anteriores a la versi\u00f3n 0.2.10 registraba incorrectamente el UID del usuario invocador en lugar del UID del usuario autenticado en la marca de tiempo de autenticaci\u00f3n. Cualquier invocaci\u00f3n posterior de 'sudo' en la misma terminal mientras la marca de tiempo segu\u00eda siendo v\u00e1lida usar\u00eda esa marca de tiempo, potencialmente eludiendo una nueva autenticaci\u00f3n incluso si la pol\u00edtica lo hubiera requerido. Un usuario con altos privilegios (capaz de ejecutar comandos como otros usuarios, o como root, a trav\u00e9s de sudo) que conozca una contrase\u00f1a de una cuenta como la que se le permite ejecutar comandos, podr\u00eda ejecutar comandos como cualquier otra cuenta para la que la pol\u00edtica les permita ejecutar comandos, incluso si no conocen la contrase\u00f1a de esas cuentas. Un caso com\u00fan de esto ser\u00eda que un usuario a\u00fan puede usar su propia contrase\u00f1a para ejecutar comandos como root (el comportamiento predeterminado de 'sudo'), negando efectivamente el comportamiento previsto de las opciones 'targetpw' o 'rootpw'. La versi\u00f3n 0.2.10 contiene un parche para el problema. Versiones anteriores a la 0.2.5 no se ven afectadas, ya que no ofrecen 'Defaults targetpw' o 'Defaults rootpw'."}], "id": "CVE-2025-64517", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 0.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-64517", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-13T15:39:22.823390Z", "version": "2.0.3"}}]}, "published": "2025-11-12T22:15:50.460", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/trifectatechfoundation/sudo-rs/commit/8423fd986c3fa58b357f238c0db5e54baca5255d."}, {"source": "security-advisories@github.com", "url": "https://github.com/trifectatechfoundation/sudo-rs/releases/tag/v0.2.10"}, {"source": "security-advisories@github.com", "url": "https://github.com/trifectatechfoundation/sudo-rs/security/advisories/GHSA-q428-6v73-fc4q"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"created": "2025-11-14T09:29:15.455224+00:00", "updated": "2025-11-14T09:29:15.455252+00:00", "vendors": ["sudo-rs", "sudo-rs$PRODUCT$sudo-rs"]}