Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 6 Nov 2023 16:53:27 +0100
From: Jakub Wilk <>
To: <>
Subject: Re: Session File Relative Path Traversal in sudo-rs

* Alan Coopersmith <>, 2023-11-02 11:40:
>This vulnerability requires two pre-conditions:
>1) Your OS allows usernames containing both '.' and '/' characters.
>2) Your site allows users to create usernames containing both '.' and 
>'/' characters, with no process or manual review that denies such 
>If both are true, when sudo-rs created a filename containing the 
>username, it failed to escape the characters, letting them be 
>interpreted by the filesystem as references to higher level directories 
>('/../..' etc.)

The original sudo implementation is affected too: says it's "a lower 
security severity due to [sudo's] use of the openat function", but I 
can't see how openat() would help.

Jakub Wilk

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.