8.2

CVE-2017-1000368: sudo_project sudo Improper Input Validation

CVSS: 8.2v3.0HighModified
AliasesALPINE-CVE-2017-1000368SUSE-SU-2017:1626-1SUSE-SU-2017:1627-1
Published 05-06-2017Last modified 05-08-2024
Open JSON

Vulnerability summary

CVE-2017-1000368 is a high (CVSS 8.2) Improper Input Validation vulnerability in sudo_project sudo. EPSS estimates a 0.57% chance of exploitation in the next 30 days, higher than 46.2% of scored vulnerabilities.

Overall risk
33/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.2/10
010
High · v3.0 (NVD)
EPSS score
0.57%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2 · Related 2
OPENSUSE-SU-2024:11413-1USN-3968-1

Timeline

  1. 05-06-2017
    PublishedVulnerability first disclosed.
  2. 05-08-2024
    Last modifiedVulnerability information updated.

Description

Todd Miller's sudo version 1.8.20p1 and earlier is vulnerable to an input validation (embedded newlines) in the get_process_ttyname() function resulting in information disclosure and command execution.

CVSS metrics

6 scores · 5 sources · 2 versions

EPSS trend

Probability

0.57%

Chance of exploitation in the next 30 days

Percentile

46%

Versus all other CVEs

30-day change

0.00 pp

From 0.57% on 18-09-2026

18-09-202618-10-2026
EPSS score
0.57%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Suse10 products
  • sudo&distro=SUSE Linux Enterprise Desktop 12 SP2< 1.8.10p3-10.10.2 | < 1.8.10p3-10.13.1
  • sudo&distro=SUSE Linux Enterprise Server 12 SP1-LTSS< 1.8.10p3-2.16.1 | < 1.8.10p3-2.19.1
  • sudo&distro=SUSE Linux Enterprise Server 12 SP2< 1.8.10p3-10.10.2 | < 1.8.10p3-10.13.1
  • sudo&distro=SUSE Linux Enterprise Server 12-LTSS< 1.8.10p3-2.16.1 | < 1.8.10p3-2.19.1
  • sudo&distro=SUSE Linux Enterprise Server for Raspberry Pi 12 SP2< 1.8.10p3-10.10.2 | < 1.8.10p3-10.13.1
Redhat3 products
  • sudo< 0:1.7.2p1-31.el5_11 | < 0:1.8.6p3-29.el6_9 | < 0:1.8.6p7-23.el7_3
  • sudo-debuginfo< 0:1.7.2p1-31.el5_11 | < 0:1.8.6p3-29.el6_9 | < 0:1.8.6p7-23.el7_3
  • sudo-devel< 0:1.8.6p3-29.el6_9 | < 0:1.8.6p7-23.el7_3
Alpine1 product
  • sudo< 1.8.20_p2-r0
Debian1 product
  • sudo< 1.8.20p1-1.1 | < 1.8.5p2-1+nmu3+deb7u4
Sudo_project1 product
  • sudo≤ 1.8.20 | 1.8.20:p1
Ubuntu1 product
  • sudo< 1.8.16-0ubuntu1.6 | < 1.8.20p2-1ubuntu1 | < 1.8.9p5-1ubuntu1.5+esm1

6 vendors · 17 products

References

29 links
Show all 29 references