{"schemaVersion":3,"id":"USN-6005-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"sudo vulnerabilities\n\nMatthieu Barjole and Victor Cutillas discovered that Sudo incorrectly\nescaped control characters in log messages and sudoreplay output. An\nattacker could possibly use these issues to inject terminal control\ncharacters that alter output when being viewed.","dates":{"published":"2023-04-11T14:19:40.000Z","modified":"2026-04-27T16:37:42.985Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"ubuntu","product":"sudo","name":"sudo","label":"sudo","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/sudo","purlType":"deb","versions":[{"text":"< 1.8.21p2-3ubuntu1.6","noFixRecorded":false,"fixedIn":null},{"text":"< 1.8.31-1ubuntu1.5","noFixRecorded":false,"fixedIn":null},{"text":"< 1.9.9-1ubuntu2.4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.8.21p2-3ubuntu1.6 | < 1.8.31-1ubuntu1.5 | < 1.9.9-1ubuntu2.4","eol":null,"hubHref":null}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://ubuntu.com/security/notices/USN-6005-1","label":"ubuntu.com/security/notices/USN-6005-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-28486","label":"ubuntu.com/security/CVE-2023-28486","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2023-28487","label":"ubuntu.com/security/CVE-2023-28487","hostname":"ubuntu.com","tags":["REPORT"]}],"lineage":{"upstream":["CVE-2023-28486","CVE-2023-28487"],"downstream":[],"duplicates":[],"related":["CVE-2023-28486","CVE-2023-28487"]},"timeline":[{"kind":"published","date":"2023-04-11T14:19:40.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-04-27T16:37:42.985Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T10:32:04.273Z","stale":false,"partial":false}}