CVE-2021-3156

Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.

Affected products

Alt Linux, Centos, Huawei Vrp, Linuxmint, Apple Macos, Red Hat, Red Os, Sudo

Sudo Project Sudo

< 1.8.32, 1.9.5

Fix

Available

CVSS 3.1

7.8 HIGH

EPSS

100.0% (100th percentile)

Weakness

CWE-193

NVD status

Analyzed

Published

2021-01-26