CVE-2023-7090
Sudo: improper handling of ipa_hostname leads to privilege mismanagement
A flaw was found in sudo in the handling of ipa_hostname, where ipa_hostname from /etc/sssd/sssd.conf was not propagated in sudo. Therefore, it leads to privilege mismanagement vulnerability in applications, where client hosts retain privileges even after retracting them.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Sudo: improper handling of ipa_hostname leads to privilege mismanagement
A flaw was found in sudo in the handling of ipa_hostname, where ipa_hostname from /etc/sssd/sssd.conf was not propagated in sudo. Therefore, it leads to privilege mismanagement vulnerability in applications, where client hosts retain privileges even after retracting them.
- Record
CVE-2023-7090- CVSS 3.1
- 6.6 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L - Weakness
- CWE-269
- Updated
- 2026-11-02
EUVDEUVD-2023-59274
A flaw was found in sudo in the handling of ipa_hostname, where ipa_hostname from /etc/sssd/sssd.conf was not propagated in sudo. Therefore, it leads to privilege mismanagement vulnerability in applications, where client hosts retain privileges even after retracting them.
- Record
EUVD-2023-59274- CVSS 3.1
- 6.6 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8mrc-5phh-m9pc
A flaw was found in sudo in the handling of ipa_hostname, where ipa_hostname from /etc/sssd/sssd...
A flaw was found in sudo in the handling of ipa_hostname, where ipa_hostname from /etc/sssd/sssd.conf was not propagated in sudo. Therefore, it leads to privilege mismanagement vulnerability in applications, where client hosts retain privileges even after retracting them.
- Record
GHSA-8mrc-5phh-m9pc- CVSS 3.1
- 6.6 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L - Weakness
- CWE-269
- Updated
- 2026-11-02
NVD
A flaw was found in sudo in the handling of ipa_hostname, where ipa_hostname from /etc/sssd/sssd.conf was not propagated in sudo. Therefore, it leads to privilege mismanagement vulnerability in applications, where client hosts retain privileges even after retracting them.
- Record
CVE-2023-7090- CVSS 3.1
- 6.6 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-269
- Updated
- 2026-11-02
OSVBELL-CVE-2023-7090
CVE-2023-7090 does not affect BellSoft software
- Record
BELL-CVE-2023-7090- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSV
Sudo: improper handling of ipa_hostname leads to privilege mismanagement
A flaw was found in sudo in the handling of ipa_hostname, where ipa_hostname from /etc/sssd/sssd.conf was not propagated in sudo. Therefore, it leads to privilege mismanagement vulnerability in applications, where client hosts retain privileges even after retracting them.
- Record
CVE-2023-7090- CVSS 3.1
- 6.6 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L - Weakness
- CWE-269
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2023-7090
A flaw was found in sudo in the handling of ipa_hostname, where ipa_hostname from /etc/sssd/sssd.conf was not propagated in sudo. Therefore, it leads to privilege mismanagement vulnerability in applications, where client hosts retain privileges even after retracting them.
- Record
DEBIAN-CVE-2023-7090- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-7090
A flaw was found in sudo in the handling of ipa_hostname, where ipa_hostname from /etc/sssd/sssd.conf was not propagated in sudo. Therefore, it leads to privilege mismanagement vulnerability in applications, where client hosts retain privileges even after retracting them.
- Record
UBUNTU-CVE-2023-7090- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 3.1
- 6.6 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
sudoDebian:12 |
before 1.8.28p1-1 | 1.8.28p1-1 |
sudoDebian:13 |
before 1.8.28p1-1 | 1.8.28p1-1 |
sudoDebian:14 |
before 1.8.28p1-1 | 1.8.28p1-1 |
sudoDebian:10 From an advisory covering 3 CVEs |
before 1.8.27-1+deb10u6, plus listed versions 1.8.27-11.8.27-1+deb10u11.8.27-1+deb10u21.8.27-1+deb10u31.8.27-1+deb10u41.8.27-1+deb10u5 |
1.8.27-1+deb10u6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-7090 is a medium vulnerability (CVSS 6.6) in Sudo Project Sudo, published December 23, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.69%, the 52nd percentile. Fixed in sudo 1.8.28p1-1.
References
access.redhat.com/security/cve/CVE-2023-7090
bugzilla.redhat.com/show_bug.cgi?id=2255723
lists.debian.org/debian-lts-announce/2024/02/msg00002.html
security.netapp.com/advisory/ntap-20240208-0001
sudo.ws/releases/legacy
nvd.nist.gov/vuln/detail/CVE-2023-7090
Show 11 moreShow less
github.com/advisories/GHSA-8mrc-5phh-m9pc
docs.bell-sw.com/security/cves/CVE-2023-7090
packages.fedoraproject.org
security-tracker.debian.org/tracker/CVE-2023-7090
ubuntu.com/security/CVE-2023-7090
cve.org/CVERecord?id=CVE-2023-7090