CVE-2025-32462

Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL, allows listed users to execute commands on unintended machines.

References

Affected packages

Debian:11 / sudo

Package

Name: sudo
Purl: pkg:deb/debian/sudo?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.9.5p2-3+deb11u2

Affected versions

1.*

1.9.5p2-3

1.9.5p2-3+deb11u1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / sudo

Package

Name: sudo
Purl: pkg:deb/debian/sudo?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.9.13p3-1+deb12u2

Affected versions

1.*

1.9.13p3-1

1.9.13p3-1+deb12u1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / sudo

Package

Name: sudo
Purl: pkg:deb/debian/sudo?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.9.16p2-3

Affected versions

1.*

1.9.13p3-1

1.9.13p3-2

1.9.13p3-3

1.9.14p2-1

1.9.15p2-1

1.9.15p2-2

1.9.15p3-1

1.9.15p4-1

1.9.15p4-2

1.9.15p5-1

1.9.15p5-2

1.9.15p5-3

1.9.15p5-3+hurd.1

1.9.16-1

1.9.16-2

1.9.16p1-1

1.9.16p2-1

1.9.16p2-2

Ecosystem specific

{
    "urgency": "not yet assigned"
}