CVE-2017-1000368: Input Validation
Published Jun 5, 2017
·Updated
Last updated 25 August 2025
Other sources
Todd Miller's sudo version 1.8.20p1 and earlier is vulnerable to an input validation (embedded newlines) in the getprocessttyname() function resulting in information disclosure and command execution.
— Launchpad
Affected Software
4 affected componentsFixes available
redhat/sudo<1.8.20
1.8.20
Sudo Project Sudo<=1.8.20
Sudo Project Sudo=1.8.20-p1
debian/sudo
1.9.5p2-3+deb11u11.9.5p2-3+deb11u31.9.13p3-1+deb12u31.9.13p3-1+deb12u21.9.16p2-3+deb13u11.9.17p2-4
Remediation
Patch Available
Event History
Jun 5, 2017
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
Data Sourced
via NVD·04:29 PM
DescriptionSeverityWeaknessAffected Software
Feb 19, 2026
Data Sourced
via Ubuntu·06:18 PM
RemedyDescriptionSeverityAffected Software
Data Sourced
via Launchpad·06:18 PM
Description
Mar 14, 2026
Data Sourced
via Debian·06:36 PM
DescriptionAffected Software
Frequently Asked Questions
1
What is the vulnerability ID for this security issue?
The vulnerability ID for this security issue is CVE-2017-1000368.
2
What is the title of this vulnerability?
The title of this vulnerability is 'Todd Miller's sudo version 1.8.20p1 and earlier is vulnerable to an input validation (embedded newlines) in the get_process_ttyname() function resulting in information disclosure and command execution.'
3
What is the severity of CVE-2017-1000368?
The severity of CVE-2017-1000368 is high with a CVSS score of 8.2.
4
What software versions are affected by this vulnerability?
Sudo version 1.8.20p1 and earlier are affected by this vulnerability.
5
How can I fix CVE-2017-1000368?
To fix CVE-2017-1000368, update to sudo version 1.8.20 or higher.