sudo-rs -- Authenticating user not recorded properly in timestamp

2025-11-16 · CVE-2025-64517 · VuXML entry

Trifecta Tech Foundation reports: With Defaults targetpw (or Defaults rootpw) enabled, the password of the target account (or root account) instead of the invoking user is used for authentication. sudo-rs prior to 0.2.10 incorrectly recorded the invoking user’s UID instead of the authenticated-as user's UID in the authentication timestamp. Any later sudo invocation on the same terminal while the timestamp was …

Affected versions

• sudo-rs >= 0.2.5 < 0.2.10
• sudo-rs-coexist >= 0.2.5 < 0.2.10

By system

0 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.