{"id":"CVE-2022-42717","aliases":["AZL-11115","EUVD-2022-45783","GHSA-mc87-5qgf-5qvj","UBUNTU-CVE-2022-42717"],"status":"published","title":"An issue was discovered in Hashicorp Packer before 2.3.1. The recommended sudoers configuration...","description":"An issue was discovered in Hashicorp Packer before 2.3.1. The recommended sudoers configuration for Vagrant on Linux is insecure. If the host has been configured according to this documentation, non-privileged users on the host can leverage a wildcard in the sudoers configuration to execute arbitrary commands as root.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00253,"percentile":0.16913,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-269","CWE-284"],"published":"2022-10-11T00:00:00Z","modified":"2026-10-28T02:30:25Z","fixes":[{"ecosystem":"Azure Linux:2","package":"packer","fixed_in":["1.8.7-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:2","package":"packer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.7-1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"vagrant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.4+dfsg-1","1.8.1+dfsg-1","1.8.1+dfsg-1ubuntu0.1","1.8.1+dfsg-1ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"vagrant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.1+dfsg-1","2.0.2+dfsg-2ubuntu2","2.0.2+dfsg-2ubuntu8"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"vagrant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.3+dfsg-1ubuntu2","2.2.6+dfsg-2ubuntu1","2.2.6+dfsg-2ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"vagrant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.14+dfsg-1ubuntu1","2.2.19+dfsg-1ubuntu1"]}],"products":[{"vendor":"hashicorp","product":"vagrant"}],"references":[{"url":"https://github.com/hashicorp/vagrant/pull/12910","tags":["x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://www.vagrantup.com/docs/synced-folders/nfs","tags":["x_transferred","Product","web","report"]},{"url":"https://discuss.hashicorp.com/t/hcsec-2022-23-vagrant-nfs-sudoers-configuration-allows-for-local-privilege-escalation/45423","tags":["x_transferred","Vendor Advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-42717","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-mc87-5qgf-5qvj"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/42xxx/CVE-2022-42717.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-42717","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-42717","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-42717","description":"An issue was discovered in Hashicorp Packer before 2.3.1. The recommended sudoers configuration for Vagrant on Linux is insecure. If the host has been configured according to this documentation, non-privileged users on the host can leverage a wildcard in the sudoers configuration to execute arbitrary commands as root.","status":"published","published":"2022-10-11T00:00:00Z","modified":"2025-05-20T14:12:42.637Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:34:27.640972Z"}],"euvd":[{"id":"EUVD-2022-45783","description":"An issue was discovered in Hashicorp Packer before 2.3.1. The recommended sudoers configuration for Vagrant on Linux is insecure. If the host has been configured according to this documentation, non-privileged users on the host can leverage a wildcard in the sudoers configuration to execute arbitrary commands as root.","status":"published","published":"2022-10-11T00:00:00Z","modified":"2025-05-20T14:12:42Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:32:43.763029Z"}],"ghsa":[{"id":"GHSA-mc87-5qgf-5qvj","title":"An issue was discovered in Hashicorp Packer before 2.3.1. The recommended sudoers configuration...","description":"An issue was discovered in Hashicorp Packer before 2.3.1. The recommended sudoers configuration for Vagrant on Linux is insecure. If the host has been configured according to this documentation, non-privileged users on the host can leverage a wildcard in the sudoers configuration to execute arbitrary commands as root.","status":"published","published":"2022-10-12T12:00:21Z","modified":"2025-05-20T15:31:39Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-269","CWE-284"],"updated_at":"2026-11-02T15:02:22.425596Z"}],"nvd":[{"id":"CVE-2022-42717","description":"An issue was discovered in Hashicorp Packer before 2.3.1. The recommended sudoers configuration for Vagrant on Linux is insecure. If the host has been configured according to this documentation, non-privileged users on the host can leverage a wildcard in the sudoers configuration to execute arbitrary commands as root.","status":"published","published":"2022-10-11T23:15:10.237Z","modified":"2026-06-17T05:05:10.943Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:07:29.52424Z"}],"osv":[{"id":"AZL-11115","title":"CVE-2022-42717 affecting package packer for versions less than 1.8.7-1","description":"An issue was discovered in Hashicorp Packer before 2.3.1. The recommended sudoers configuration for Vagrant on Linux is insecure. If the host has been configured according to this documentation, non-privileged users on the host can leverage a wildcard in the sudoers configuration to execute arbitrary commands as root.","status":"published","published":"2022-10-11T23:15:10Z","modified":"2026-04-21T04:21:49.808579Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:02.368326Z"},{"id":"CVE-2022-42717","description":"An issue was discovered in Hashicorp Packer before 2.3.1. The recommended sudoers configuration for Vagrant on Linux is insecure. If the host has been configured according to this documentation, non-privileged users on the host can leverage a wildcard in the sudoers configuration to execute arbitrary commands as root.","status":"published","published":"2022-10-11T00:00:00Z","modified":"2026-10-28T02:30:25.121741707Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:27.186787Z"},{"id":"UBUNTU-CVE-2022-42717","description":"An issue was discovered in Hashicorp Packer before 2.3.1. The recommended sudoers configuration for Vagrant on Linux is insecure. If the host has been configured according to this documentation, non-privileged users on the host can leverage a wildcard in the sudoers configuration to execute arbitrary commands as root.","status":"published","published":"2022-10-11T23:15:00Z","modified":"2025-10-24T04:53:56Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:53:55.502114Z"}]}}