USN-8708-2
rust-sudo-rs vulnerability
USN-8708-1 fixed a vulnerability in sudo-rs. This update provides the corresponding fix for Ubuntu 26.10.
Original advisory details:
It was discovered that sudo-rs incorrectly handled time-of-check vs time- of-use conditions in sudoedit. A local attacker with permission to edit specific files using sudoedit could use this issue to place files in arbitrary directories, and possibly escalate their privileges. This issue only affected systems configured to grant fine-grained sudoedit file editing permissions, which is not the default configuration.
What each source reports
OSV No score
rust-sudo-rs vulnerability
USN-8708-1 fixed a vulnerability in sudo-rs. This update provides the corresponding fix for Ubuntu 26.10.
Original advisory details:
It was discovered that sudo-rs incorrectly handled time-of-check vs time- of-use conditions in sudoedit. A local attacker with permission to edit specific files using sudoedit could use this issue to place files in arbitrary directories, and possibly escalate their privileges. This issue only affected systems configured to grant fine-grained sudoedit file editing permissions, which is not the default configuration.
- Record
USN-8708-2- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
rust-sudo-rsUbuntu:26.10 |
before 0.2.14-1ubuntu4.1, plus listed versions 0.2.13-0ubuntu10.2.14-1ubuntu20.2.14-1ubuntu4 |
0.2.14-1ubuntu4.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
USN-8708-2 is a vulnerability with no CVSS score yet in rust-sudo-rs, published October 20, 2026. No source lists public exploit code. Fixed in rust-sudo-rs 0.2.14-1ubuntu4.1.