CVE-2023-28486

Sudo before 1.9.13 does not escape control characters in log messages.

Score

CVSS 3.1 5.3 Medium

Status

Modified - cve@mitre.org

Published

2023-03-16

Last modified

2024-08-02

Weaknesses

CWE-116

Affected products

• Active Iq Unified Manager (Netapp)
• Sudo (Sudo Project)

References

• https://github.com/sudo-project/sudo/commit/334daf92b31b79ce68ed75e2ee14fca265f029ca
• https://github.com/sudo-project/sudo/releases/tag/SUDO_1_9_13
• https://lists.debian.org/debian-lts-announce/2024/02/msg00002.html
• https://security.gentoo.org/glsa/202309-12
• https://security.netapp.com/advisory/ntap-20230420-0002/