{"id":"CVE-2023-28486","aliases":["ALSA-2024:0811","BELL-CVE-2023-28486","CLSA-2023-1689258488","CLSA-2024-1711476502","CLSA-2024-1719919908","CLSA-2024-1719920793","CLSA-2026-1777377545","CLSA-2026-1777378006","CLSA-2026-1790600964","CLSA-2026-1790601456","CLSA-2026-1790606589","DEBIAN-CVE-2023-28486","DLA-3732-1","DLA-4472-1","EUVD-2023-32156","GHSA-pr34-r4f9-f5c6","MGASA-2023-0133","OESA-2023-1205","RHSA-2024:0811","SUSE-SU-2023:1659-1","SUSE-SU-2023:1665-1","SUSE-SU-2023:1698-1","SUSE-SU-2023:1699-1","SUSE-SU-2023:1700-1","UBUNTU-CVE-2023-28486","USN-6005-1","USN-6005-2"],"status":"published","title":"Sudo before 1.9.13 does not escape control characters in log messages.","description":"Sudo before 1.9.13 does not escape control characters in log messages.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00915,"percentile":0.60392,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-116"],"published":"2023-03-16T00:00:00Z","modified":"2026-10-29T11:31:40Z","fixes":[{"ecosystem":"Alpaquita:23","package":"sudo","fixed_in":["1.9.15_p5-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"sudo","fixed_in":["1.9.13p1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"sudo","fixed_in":["1.9.13p1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"sudo","fixed_in":["1.9.13p1-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"sudo","fixed_in":["1.8.16-0ubuntu1.10+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"sudo","fixed_in":["1.8.21p2-3ubuntu1.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"sudo","fixed_in":["1.8.31-1ubuntu1.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"sudo","fixed_in":["1.9.9-1ubuntu2.4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.5p2-10.el9_3"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"sudo-python-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.5p2-10.el9_3"}]}],"bundled":3},{"source":"osv","ecosystem":"Alpaquita:23","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.9.12_p1-r1"},{"fixed":"1.9.15_p5-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.16-0ubuntu1.11+tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"sudo-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.16-0ubuntu1.11+tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.5p2-9.el9.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"sudo-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.5p2-9.el9.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"sudo-python-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.5p2-9.el9.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.29-7.el8_4.1.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"sudo-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.29-7.el8_4.1.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.29-7.el8_4.1.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"sudo-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.29-7.el8_4.1.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.23-10.0.1.el7_9.3.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"sudo-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.23-10.0.1.el7_9.3.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.23-10.0.1.el7_9.3.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"sudo-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.23-10.0.1.el7_9.3.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.23-10.0.3.el7_9.3.tuxcare.els1"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"sudo-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.23-10.0.3.el7_9.3.tuxcare.els1"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.23-10.0.3.el7_9.3.tuxcare.els1"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"sudo-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.23-10.0.3.el7_9.3.tuxcare.els1"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.23-10.0.3.el7_9.3.tuxcare.els1"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"sudo-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.23-10.0.3.el7_9.3.tuxcare.els1"}]}],"bundled":7},{"source":"osv","ecosystem":"Debian:12","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.13p1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.13p1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.13p1-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.27-1+deb10u6"}]}],"versions":["1.8.27-1","1.8.27-1+deb10u1","1.8.27-1+deb10u2","1.8.27-1+deb10u3","1.8.27-1+deb10u4","1.8.27-1+deb10u5"],"bundled":3},{"source":"osv","ecosystem":"Debian:11","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.5p2-3+deb11u3"}]}],"versions":["1.9.5p2-3","1.9.5p2-3+deb11u1","1.9.5p2-3+deb11u2"],"bundled":2},{"source":"osv","ecosystem":"Mageia:8","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.5p2-2.3.mga8"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.2-11.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.2-11.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.8p2-11.oe2203sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.8p2-11.oe2203sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"sudo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.5p2-7.el9_0.4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"sudo-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.5p2-7.el9_0.4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"sudo-python-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.5p2-7.el9_0.4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"sudo-python-plugin-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.5p2-7.el9_0.4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"sudo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.5p2-9.el9_2.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"sudo-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.5p2-9.el9_2.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"sudo-python-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.5p2-9.el9_2.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"sudo-python-plugin-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.5p2-9.el9_2.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"sudo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.5p2-10.el9_3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"sudo-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.5p2-10.el9_3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"sudo-python-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.5p2-10.el9_3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"sudo-python-plugin-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.5p2-10.el9_3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::baseos","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.5p2-1.el8_6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::baseos","package":"sudo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.5p2-1.el8_6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::baseos","package":"sudo-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.5p2-1.el8_6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::baseos","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.5p2-1.el8_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::baseos","package":"sudo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.5p2-1.el8_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::baseos","package":"sudo-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.5p2-1.el8_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.5p2-1.el8_9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"sudo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.5p2-1.el8_9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"sudo-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.5p2-1.el8_9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::baseos","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.5p2-7.el9_0.4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::baseos","package":"sudo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.5p2-7.el9_0.4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::baseos","package":"sudo-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.5p2-7.el9_0.4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::baseos","package":"sudo-python-plugin-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.5p2-7.el9_0.4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::baseos","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.5p2-9.el9_2.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::baseos","package":"sudo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.5p2-9.el9_2.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::baseos","package":"sudo-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.5p2-9.el9_2.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::baseos","package":"sudo-python-plugin-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.5p2-9.el9_2.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.5p2-10.el9_3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"sudo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.5p2-10.el9_3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"sudo-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.5p2-10.el9_3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"sudo-python-plugin-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.5p2-10.el9_3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.27-4.38.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.27-4.38.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.27-4.38.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.9-150400.4.26.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.9-150400.4.26.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.9-150400.4.26.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.3","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.9-150400.4.26.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.9-150400.4.26.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.5p2-150300.3.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.5p2-150300.3.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP3","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.5p2-150300.3.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.5p2-150300.3.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.5p2-150300.3.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.2","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.5p2-150300.3.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 4.2","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.5p2-150300.3.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.5p2-150300.3.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.5p2-150300.3.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.5p2-150300.3.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.27-150000.4.43.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.27-150000.4.43.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.27-150000.4.43.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.27-150000.4.43.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.27-150000.4.43.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.27-150000.4.43.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.27-150000.4.43.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.20p2-3.39.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.20p2-3.39.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.20p2-3.39.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-ESPOS","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.20p2-3.39.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.20p2-3.39.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.6p3-0ubuntu3","1.8.8-2ubuntu1","1.8.8-2ubuntu2","1.8.9p4-1ubuntu1","1.8.9p4-1ubuntu2","1.8.9p5-1ubuntu1","1.8.9p5-1ubuntu1.1","1.8.9p5-1ubuntu1.2","1.8.9p5-1ubuntu1.3","1.8.9p5-1ubuntu1.4","1.8.9p5-1ubuntu1.5+esm1","1.8.9p5-1ubuntu1.5+esm2","1.8.9p5-1ubuntu1.5+esm3","1.8.9p5-1ubuntu1.5+esm5","1.8.9p5-1ubuntu1.5+esm6","1.8.9p5-1ubuntu1.5+esm7","1.8.9p5-1ubuntu1.5+esm8"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.16-0ubuntu1.10+esm2"}]}],"versions":["1.8.12-1ubuntu3","1.8.16-0ubuntu1","1.8.16-0ubuntu1.1","1.8.16-0ubuntu1.2","1.8.16-0ubuntu1.3","1.8.16-0ubuntu1.4","1.8.16-0ubuntu1.5","1.8.16-0ubuntu1.6","1.8.16-0ubuntu1.7","1.8.16-0ubuntu1.8","1.8.16-0ubuntu1.9","1.8.16-0ubuntu1.10","1.8.16-0ubuntu1.10+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.21p2-3ubuntu1.6"}]}],"versions":["1.8.20p2-1ubuntu1","1.8.21p2-2ubuntu1","1.8.21p2-3ubuntu1","1.8.21p2-3ubuntu1.1","1.8.21p2-3ubuntu1.2","1.8.21p2-3ubuntu1.3","1.8.21p2-3ubuntu1.4","1.8.21p2-3ubuntu1.5"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.31-1ubuntu1.5"}]}],"versions":["1.8.27-1ubuntu4","1.8.29-1ubuntu1","1.8.31-1ubuntu1","1.8.31-1ubuntu1.1","1.8.31-1ubuntu1.2","1.8.31-1ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.9-1ubuntu2.4"}]}],"versions":["1.9.5p2-3ubuntu2","1.9.9-1ubuntu2","1.9.9-1ubuntu2.1","1.9.9-1ubuntu2.2","1.9.9-1ubuntu2.3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.21p2-3ubuntu1.6"}]}],"versions":["1.8.20p2-1ubuntu1","1.8.21p2-2ubuntu1","1.8.21p2-3ubuntu1","1.8.21p2-3ubuntu1.1","1.8.21p2-3ubuntu1.2","1.8.21p2-3ubuntu1.3","1.8.21p2-3ubuntu1.4","1.8.21p2-3ubuntu1.5"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.31-1ubuntu1.5"}]}],"versions":["1.8.27-1ubuntu4","1.8.29-1ubuntu1","1.8.31-1ubuntu1","1.8.31-1ubuntu1.1","1.8.31-1ubuntu1.2","1.8.31-1ubuntu1.4"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.9-1ubuntu2.4"}]}],"versions":["1.9.5p2-3ubuntu2","1.9.9-1ubuntu2","1.9.9-1ubuntu2.1","1.9.9-1ubuntu2.2","1.9.9-1ubuntu2.3"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.16-0ubuntu1.10+esm2"}]}],"versions":["1.8.12-1ubuntu3","1.8.16-0ubuntu1","1.8.16-0ubuntu1.1","1.8.16-0ubuntu1.2","1.8.16-0ubuntu1.3","1.8.16-0ubuntu1.4","1.8.16-0ubuntu1.5","1.8.16-0ubuntu1.6","1.8.16-0ubuntu1.7","1.8.16-0ubuntu1.8","1.8.16-0ubuntu1.9","1.8.16-0ubuntu1.10","1.8.16-0ubuntu1.10+esm1"],"bundled":2}],"products":[{"vendor":"netapp","product":"active_iq_unified_manager"},{"vendor":"sudo_project","product":"sudo"}],"references":[{"url":"https://github.com/sudo-project/sudo/commit/334daf92b31b79ce68ed75e2ee14fca265f029ca","tags":["x_transferred","Patch","fix"]},{"url":"https://github.com/sudo-project/sudo/releases/tag/SUDO_1_9_13","tags":["x_transferred","Release Notes","web","report"]},{"url":"https://security.netapp.com/advisory/ntap-20230420-0002/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/202309-12","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/02/msg00002.html","tags":["mailing-list","x_transferred","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-28486","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-pr34-r4f9-f5c6"},{"url":"https://access.redhat.com/errata/RHSA-2024:0811","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-28486","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-28487","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-42465","tags":["report"]},{"url":"https://bugzilla.redhat.com/2179272","tags":["report"]},{"url":"https://bugzilla.redhat.com/2179273","tags":["report"]},{"url":"https://bugzilla.redhat.com/2255568","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-0811.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2023-28486","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu16_04-els/CLSA-2023-1689258488","tags":["advisory"]},{"url":"https://errata.tuxcare.com/almalinux9.2-esu/CLSA-2024-1711476502.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.4-els/CLSA-2024-1719919908.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.5-els/CLSA-2024-1719920793.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1777377545.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/rhel7els/CLSA-2026-1777378006.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/rhel7els/CLSA-2026-1790600964.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1790601456.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1790606589.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28486.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-28486","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2023-0133.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=31738","tags":["report"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2023-March/014226.html","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1205","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-28487","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2179272","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2179273","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2255568","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0811.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-28486","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-28487","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-42465","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-42465","tags":["advisory"]},{"url":"https://arxiv.org/pdf/2309.02545.pdf","tags":["article"]},{"url":"https://github.com/sudo-project/sudo/commit/7873f8334c8d31031f8cfa83bd97ac6029309e4f","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20231659-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1203201","tags":["report"]},{"url":"https://bugzilla.suse.com/1206483","tags":["report"]},{"url":"https://bugzilla.suse.com/1209361","tags":["report"]},{"url":"https://bugzilla.suse.com/1209362","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28486","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28487","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20231665-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1206772","tags":["report"]},{"url":"https://bugzilla.suse.com/1208595","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-27320","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20231698-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20231699-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20231700-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-28486","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6005-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-6005-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-28487","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-28486","description":"Sudo before 1.9.13 does not escape control characters in log messages.","status":"published","published":"2023-03-16T00:00:00Z","modified":"2024-08-02T12:38:25.511Z","updated_at":"2026-11-02T14:35:32.376766Z"}],"euvd":[{"id":"EUVD-2023-32156","description":"Sudo before 1.9.13 does not escape control characters in log messages.","status":"published","published":"2023-03-16T00:00:00Z","modified":"2024-08-02T12:38:25Z","updated_at":"2026-11-03T03:50:06.256765Z"}],"ghsa":[{"id":"GHSA-pr34-r4f9-f5c6","title":"Sudo before 1.9.13 does not escape control characters in log messages.","description":"Sudo before 1.9.13 does not escape control characters in log messages.","status":"published","published":"2023-03-16T03:30:17Z","modified":"2024-02-03T12:30:24Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T14:55:33.593991Z"}],"nvd":[{"id":"CVE-2023-28486","description":"Sudo before 1.9.13 does not escape control characters in log messages.","status":"published","published":"2023-03-16T01:15:47.003Z","modified":"2026-06-17T05:47:51.18Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T14:07:49.031498Z"}],"osv":[{"id":"BELL-CVE-2023-28486","status":"published","published":"2023-03-16T01:15:00Z","modified":"2026-01-26T09:34:50.041123Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:17.742221Z"},{"id":"DEBIAN-CVE-2023-28486","description":"Sudo before 1.9.13 does not escape control characters in log messages.","status":"published","published":"2023-03-16T01:15:47.003Z","modified":"2026-10-26T18:00:47.884039976Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:39.679062Z"},{"id":"OESA-2023-1205","title":"sudo security update","description":"Sudo is a program designed to allow a sysadmin to give limited root privileges to users and log root activity.  The basic philosophy is to give as few privileges as possible but still allow people to get their work done.\r\n\r\nSecurity Fix(es):\r\n\r\nSudo before 1.9.13 does not escape control characters in sudoreplay output.(CVE-2023-28487)\r\n\r\nSudo before 1.9.13 does not escape control characters in log messages.(CVE-2023-28486)","status":"published","published":"2023-04-11T11:05:40Z","modified":"2026-08-18T01:17:38.86439397Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:39.934788Z"},{"id":"RHSA-2024:0811","title":"Red Hat Security Advisory: sudo security update","status":"published","published":"2024-09-16T12:46:41Z","modified":"2026-06-26T12:22:21.988977626Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:12.270484Z"},{"id":"UBUNTU-CVE-2023-28486","description":"Sudo before 1.9.13 does not escape control characters in log messages.","status":"published","published":"2023-03-16T01:15:00Z","modified":"2026-02-04T02:55:34.035139Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:20.997471Z"},{"id":"ALSA-2024:0811","title":"Moderate: sudo security update","description":"The sudo packages contain the sudo utility which allows system\nadministrators to provide certain users with the permission to execute\nprivileged commands, which are used for system management purposes, without\nhaving to log in as root.\n\nBug Fix(es) and Enhancement(s):\n\n* CVE-2023-28487 sudo: Sudo does not escape control characters in sudoreplay output\n* CVE-2023-28486 sudo: Sudo does not escape control characters in log messages\n* CVE-2023-42465 sudo: Targeted Corruption of Register and Stack Variables","status":"published","published":"2024-02-14T00:00:00Z","modified":"2026-10-29T11:31:40.399612828Z","updated_at":"2026-11-02T15:27:52.091404Z"},{"id":"CLSA-2023-1689258488","title":"Fix CVE(s): CVE-2023-28486, CVE-2023-2848, CVE-2023-28487","description":"\n   * SECURITY UPDATE: control characters are not escaped\n     - debian/patches/CVE-2023-2848x.patch: escape control chars\n     - CVE-2023-28486\n     - CVE-2023-28487","status":"published","published":"2023-07-13T14:28:12Z","modified":"2026-06-04T10:04:23.724167835Z","updated_at":"2026-11-02T15:43:40.509998Z"},{"id":"CLSA-2024-1711476502","title":"sudo: Fix of 2 CVEs","description":"- CVE-2023-28486: Escape control characters in log messages\n- CVE-2023-28487: Escape control characters in sudoreplay output","status":"published","published":"2024-03-26T18:08:25Z","modified":"2026-06-01T00:30:14.631732563Z","updated_at":"2026-11-02T15:43:40.88185Z"},{"id":"CLSA-2024-1719919908","title":"sudo: Fix of 2 CVEs","description":"- CVE-2023-28486: escape control characters in log messages\n- CVE-2023-28487: escape control characters in sudoreplay output","status":"published","published":"2024-07-02T11:31:51Z","modified":"2026-06-01T00:33:20.318571786Z","updated_at":"2026-11-02T15:43:40.88185Z"},{"id":"CLSA-2024-1719920793","title":"sudo: Fix of 2 CVEs","description":"- CVE-2023-28486: escape control characters in log messages\n- CVE-2023-28487: escape control characters in sudoreplay output","status":"published","published":"2024-07-02T11:46:36Z","modified":"2026-06-01T00:33:22.563046477Z","updated_at":"2026-11-02T15:43:40.88185Z"},{"id":"CLSA-2026-1777377545","title":"sudo: Fix of 3 CVEs","description":"- CVE-2021-23239: fix potential directory existence info leak in sudoedit\n- CVE-2023-28486: escape control characters in log messages\n- CVE-2023-28487: escape control characters in sudoreplay output","status":"published","published":"2026-04-28T11:59:12Z","modified":"2026-06-01T00:33:27.190080081Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1777378006","title":"sudo: Fix of 3 CVEs","description":"- CVE-2021-23239: fix potential directory existence info leak in sudoedit\n- CVE-2023-28486: escape control characters in log messages\n- CVE-2023-28487: escape control characters in sudoreplay output","status":"published","published":"2026-04-28T12:06:55Z","modified":"2026-06-01T00:33:20.226937104Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1790600964","title":"sudo: Fix of 7 CVEs","description":"- Rebase onto the vendor's sudo-1.8.23-10.0.3.el7_9.3 sources\n- CVE-2025-32462: take the vendor's fix, keep our audit record of the\n  rejected remote host\n- CVE-2026-35535 is now fixed by the vendor (sudo-1.8.23-CVE-2026-35535.patch);\n  the TuxCare duplicate is dropped\n- Retained TuxCare fixes: CVE-2021-23239, CVE-2021-23240, CVE-2023-28486,\n  CVE-2023-28487, CVE-2023-42465","status":"published","published":"2026-09-28T13:09:33Z","modified":"2026-10-26T09:43:39.785803477Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790601456","title":"sudo: Fix of 7 CVEs","description":"- Rebase onto the vendor's sudo-1.8.23-10.0.3.el7_9.3 sources\n- CVE-2025-32462: take the vendor's fix, keep our audit record of the\n  rejected remote host\n- CVE-2026-35535 is now fixed by the vendor (sudo-1.8.23-CVE-2026-35535.patch);\n  the TuxCare duplicate is dropped\n- Retained TuxCare fixes: CVE-2021-23239, CVE-2021-23240, CVE-2023-28486,\n  CVE-2023-28487, CVE-2023-42465","status":"published","published":"2026-09-28T13:17:45Z","modified":"2026-10-26T09:43:13.516156002Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790606589","title":"sudo: Fix of 7 CVEs","description":"- Rebase onto the vendor's sudo-1.8.23-10.0.3.el7_9.3 sources\n- CVE-2025-32462: take the vendor's fix, keep our audit record of the\n  rejected remote host\n- CVE-2026-35535 is now fixed by the vendor (sudo-1.8.23-CVE-2026-35535.patch);\n  the TuxCare duplicate is dropped\n- Retained TuxCare fixes: CVE-2021-23239, CVE-2021-23240, CVE-2023-28486,\n  CVE-2023-28487, CVE-2023-42465","status":"published","published":"2026-09-30T16:36:16Z","modified":"2026-10-26T09:43:53.696880037Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CVE-2023-28486","description":"Sudo before 1.9.13 does not escape control characters in log messages.","status":"published","published":"2023-03-16T00:00:00Z","modified":"2026-10-28T10:38:40.745893043Z","updated_at":"2026-11-02T15:44:31.468318Z"},{"id":"DLA-3732-1","title":"sudo - security update","status":"published","published":"2024-02-03T00:00:00Z","modified":"2026-03-09T01:22:15.349503Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DLA-4472-1","title":"sudo - security update","status":"published","published":"2026-02-06T00:00:00Z","modified":"2026-02-06T22:30:09.989133Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"MGASA-2023-0133","title":"Updated sudo packages fix security vulnerability","description":"Sudo before 1.9.13 does not escape control characters in log messages.\n(CVE-2023-28486)\nSudo before 1.9.13 does not escape control characters in sudoreplay\noutput. (CVE-2023-28487)\n","status":"published","published":"2023-04-11T19:02:20Z","modified":"2026-04-16T04:43:02.452407198Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"SUSE-SU-2023:1659-1","title":"Security update for sudo","description":"This update for sudo fixes the following issue:\n\nSecurity fixes:\n\n- CVE-2023-28486: Fixed missing control characters escaping in log messages (bsc#1209362).\n- CVE-2023-28487: Fixed missing control characters escaping in sudoreplay output (bsc#1209361).\n\nOther fixes:\n\n- Fix a situation where 'sudo -U otheruser -l' would dereference a NULL pointer (bsc#1206483).\n- Do not re-enable the reader when flushing the buffers as part of pty_finish() (bsc#1203201).\n","status":"published","published":"2023-03-29T08:16:36Z","modified":"2026-02-04T02:13:15.999958Z","updated_at":"2026-11-02T15:53:52.350754Z"},{"id":"SUSE-SU-2023:1665-1","title":"Security update for sudo","description":"This update for sudo fixes the following issue:\n\nSecurity issues:\n\n- CVE-2023-28486: Fixed sudo does not escape control characters in log messages. (bsc#1209362)\n- CVE-2023-28487: Fixed sudo does not escape control characters in sudoreplay output. (bsc#1209361)\n- CVE-2023-27320: Fixed a potential security issue with a double free with per-command chroot sudoers rules (bsc#1208595).\n\nBug fixes:\n\n- Fix a situation where 'sudo -U otheruser -l' would dereference a NULL pointer (bsc#1206483)\n- If NOPASSWD is specified, don't ask for password if command is not found (bsc#1206772).\n- Do not re-enable the reader when flushing the buffers as part of pty_finish() (bsc#1203201).\n","status":"published","published":"2023-03-29T10:55:22Z","modified":"2026-02-04T02:21:37.486364Z","updated_at":"2026-11-02T15:53:52.350754Z"},{"id":"SUSE-SU-2023:1698-1","title":"Security update for sudo","description":"This update for sudo fixes the following issue:\n\nSecurity fixes:\n\n- CVE-2023-28486: Fixed missing control characters escaping in log messages (bsc#1209362).\n- CVE-2023-28487: Fixed missing control characters escaping in sudoreplay output (bsc#1209361).\n\nOther fixes:\n\n- Fix a situation where 'sudo -U otheruser -l' would dereference a NULL pointer (bsc#1206483).\n- Do not re-enable the reader when flushing the buffers as part of pty_finish() (bsc#1203201).\n","status":"published","published":"2023-03-30T10:17:16Z","modified":"2026-02-04T03:25:25.301325Z","updated_at":"2026-11-02T15:53:52.350754Z"},{"id":"SUSE-SU-2023:1699-1","title":"Security update for sudo","description":"This update for sudo fixes the following issue:\n\nSecurity fixes:\n\n- CVE-2023-28486: Fixed missing control characters escaping in log messages (bsc#1209362).\n- CVE-2023-28487: Fixed missing control characters escaping in sudoreplay output (bsc#1209361).\n\nOther fixes:\n\n- Fix a situation where 'sudo -U otheruser -l' would dereference a NULL pointer (bsc#1206483).\n- Do not re-enable the reader when flushing the buffers as part of pty_finish() (bsc#1203201).\n","status":"published","published":"2023-03-30T10:18:46Z","modified":"2026-02-04T04:35:59.015345Z","updated_at":"2026-11-02T15:53:52.350754Z"},{"id":"SUSE-SU-2023:1700-1","title":"Security update for sudo","description":"This update for sudo fixes the following issues:\n\n- CVE-2023-28486: Fixed missing control characters escaping in log messages (bsc#1209362).\n- CVE-2023-28487: Fixed missing control characters escaping in sudoreplay output (bsc#1209361).\n","status":"published","published":"2023-03-30T10:19:35Z","modified":"2026-02-04T03:03:46.232861Z","updated_at":"2026-11-02T15:53:52.350754Z"},{"id":"USN-6005-1","title":"sudo vulnerabilities","description":"Matthieu Barjole and Victor Cutillas discovered that Sudo incorrectly\nescaped control characters in log messages and sudoreplay output. An\nattacker could possibly use these issues to inject terminal control\ncharacters that alter output when being viewed.\n","status":"published","published":"2023-04-11T14:19:40Z","modified":"2026-04-27T16:37:42.985276Z","updated_at":"2026-11-02T16:58:16.738762Z"},{"id":"USN-6005-2","title":"sudo vulnerabilities","description":"USN-6005-1 fixed vulnerabilities in Sudo. This update\nprovides the corresponding updates for Ubuntu 16.04 LTS.\n\nOriginal advisory details:\n\n Matthieu Barjole and Victor Cutillas discovered that Sudo incorrectly\n escaped control characters in log messages and sudoreplay output. An\n attacker could possibly use these issues to inject terminal control\n characters that alter output when being viewed.\n","status":"published","published":"2023-05-29T11:02:51Z","modified":"2026-06-25T13:31:58.552765564Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}