Vulnerability in Trifectatechfoundation Sudo-Rs
CVE-2025-64170
sudo-rs is a memory safe implementation of sudo and su written in Rust. Starting in version 0.2.7 and prior to version 0.2.10, if a user begins entering a password but does not press return for an extended period, a password timeout may occur. When this happens, the keystrokes that were entered are echoed back to the console. This could reveal partial password information, possibly exposing history files when not carefully handled by the user and on screen, usable for Social Engineering or Pass-By attacks. Version 0.2.10 fixes the issue.
EPSS: 0.001 (3.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 3.8 (Low). Vector: CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N.
Affected products
- Trifectatechfoundation Sudo-rs — versions >= 0.2.7, < 0.2.10
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)
Frequently asked questions
- What is CVE-2025-64170?
- CVE-2025-64170 is a low-severity vulnerability in Trifectatechfoundation Sudo-Rs, classified under CWE-549. CVSS score: 3.8/10. Published 2025-11-12.
- How severe is CVE-2025-64170?
- Low severity. CVSS v3 base score is 3.8 out of 10.