Skip to content
Heist/ feed
Back to feed
UnratedFix available

rust-sudo-rs vulnerability

Type: advisorySources: OSV

USN-8708-1 fixed a vulnerability in sudo-rs. This update provides the corresponding fix for Ubuntu 26.10. Original advisory details: It was discovered that sudo-rs incorrectly handled time-of-check vs time- of-use conditions in sudoedit. A local attacker with permission to edit specific files using sudoedit could use this issue to place files in arbitrary directories, and possibly escalate their privileges. This issue only affected systems configured to grant fine-grained sudoedit file editing permissions, which is not the default configuration.

Products
rust-sudo-rs
Affected versions
0.2.13-0ubuntu1, 0.2.14-1ubuntu2, 0.2.14-1ubuntu4
Fixed versions
0.2.14-1ubuntu4.1
CVEs
Not specified
Confirmed fixed CVEs
Not specified
Updated in this feed
31 Oct 2026, 13:26 UTC · Revision 1

Source evidence

rust-sudo-rs vulnerability

core-osv · Original source

Published 20 Oct 2026, 14:23 UTC

USN-8708-1 fixed a vulnerability in sudo-rs. This update provides the corresponding fix for Ubuntu 26.10. Original advisory details: It was discovered that sudo-rs incorrectly handled time-of-check vs time- of-use conditions in sudoedit. A local attacker with permission to edit specific files using sudoedit could use this issue to place files in arbitrary directories, and possibly escalate their privileges. This issue only affected systems configured to grant fine-grained sudoedit file editing permissions, which is not the default configuration.

osv:USN-8708-2

rust-sudo-rs

Fixed versions: 0.2.14-1ubuntu4.1

Complete source record
{
  "id": "0a8568669430d8ec2c26a1d998391238f38bafa16dae538f5c3809b319171b4d",
  "url": "https://osv.dev/vulnerability/USN-8708-2",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "rust-sudo-rs vulnerability",
    "summary": "USN-8708-1 fixed a vulnerability in sudo-rs. This update provides the corresponding fix for Ubuntu 26.10. Original advisory details: It was discovered that sudo-rs incorrectly handled time-of-check vs time- of-use conditions in sudoedit. A local attacker with permission to edit specific files using sudoedit could use this issue to place files in arbitrary directories, and possibly escalate their privileges. This issue only affected systems configured to grant fine-grained sudoedit file editing permissions, which is not the default configuration.",
    "evidence": "osv:USN-8708-2",
    "products": [
      {
        "name": {
          "value": "rust-sudo-rs",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "0.2.14-1ubuntu4.1",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": [
          {
            "value": "0.2.13-0ubuntu1",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.2.14-1ubuntu2",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.2.14-1ubuntu4",
            "evidence": "/affected/0/versions"
          }
        ]
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "USN-8708-2",
      "aliases": [
        "USN-8708-2"
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "0.2.14-1ubuntu4.1"
                }
              ]
            }
          ],
          "package": {
            "name": "rust-sudo-rs",
            "purl": "pkg:deb/ubuntu/rust-sudo-rs?arch=source&distro=stonking",
            "ecosystem": "Ubuntu:26.10"
          },
          "versions": [
            "0.2.13-0ubuntu1",
            "0.2.14-1ubuntu2",
            "0.2.14-1ubuntu4"
          ],
          "database_specific": {
            "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8708-2.json",
            "cves_map": {
              "cves": [],
              "ecosystem": "Ubuntu:26.10"
            }
          },
          "ecosystem_specific": {
            "binaries": [
              {
                "binary_name": "sudo-rs",
                "binary_version": "0.2.14-1ubuntu4.1"
              }
            ],
            "availability": "No subscription required"
          }
        }
      ],
      "modified": "2026-10-20T22:45:06.483291498Z",
      "provider": "osv",
      "references": [
        "https://ubuntu.com/security/notices/USN-8708-2",
        "https://bugs.launchpad.net/bugs/2165142"
      ]
    },
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 390718,
  "published_at": "2026-10-20T14:23:39+00:00"
}