CVE-2023-28487

Reference Links

• https://github.com/sudo-project/sudo/commit/334daf92b31b79ce68ed75e2ee14fca265f029ca
• https://github.com/sudo-project/sudo/releases/tag/SUDO_1_9_13
• https://security.gentoo.org/glsa/202309-12
• https://security.netapp.com/advisory/ntap-20230420-0002/
• https://lists.debian.org/debian-lts-announce/2024/02/msg00002.html
• https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2179276
• https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2179277
• https://access.redhat.com/errata/RHSA-2024:0811
• https://bugzilla.redhat.com/show_bug.cgi?id=2179273
• https://exchange.xforce.ibmcloud.com/vulnerabilities/250350
• https://www.ibm.com/support/pages/node/7144861 (Advisory)

Parent vulnerabilities

(Appears in the following advisories)

• IBM-7144861

Frequently Asked Questions

• What is the vulnerability ID of this vulnerability?

  The vulnerability ID of this vulnerability is CVE-2023-28487.

• What is the title of this vulnerability?

  The title of this vulnerability is 'Sudo before 1.9.13 does not escape control characters in sudoreplay output.'

• What is the description of this vulnerability?

  The description of this vulnerability is 'Sudo before 1.9.13 does not escape control characters in sudoreplay output.'

• What software is affected by this vulnerability?

  The software affected by this vulnerability is Sudo Project Sudo before version 1.9.13.

• What is the severity of this vulnerability?

  The severity of this vulnerability is medium (5.3).

• How can I fix this vulnerability?

  To fix this vulnerability, update to Sudo version 1.9.13 or later.

• Where can I find more information about this vulnerability?

  You can find more information about this vulnerability at the following references: [Link to GitHub commit](https://github.com/sudo-project/sudo/commit/334daf92b31b79ce68ed75e2ee14fca265f029ca), [Link to GitHub release](https://github.com/sudo-project/sudo/releases/tag/SUDO_1_9_13), [Link to Gentoo advisory](https://security.gentoo.org/glsa/202309-12).

• What is the Common Weakness Enumeration (CWE) ID for this vulnerability?

  The Common Weakness Enumeration (CWE) ID for this vulnerability is 116.