CVE catalog

CVE-2025-64170

DEBIAN-CVE-2025-64170

[CVE catalog]

Severity
Low · CVSS 3.8CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.15% · Oct 25, 2026

sudo-rs is a memory safe implementation of sudo and su written in Rust. Starting in version 0.2.7 and prior to version 0.2.10, if a user begins entering a password but does not press return for an extended period, a password timeout may occur. When this happens, the keystrokes that were entered are echoed back to the console. This could reveal partial password information, possibly exposing history files when not carefully handled by the user and on screen, usable for Social Engineering or Pass-By attacks. Version 0.2.10 fixes the issue.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianrust-sudo-rs130.2.5-5vulnerable
Debianrust-sudo-rs130.2.5-5+deb13u1fixed
Debianrust-sudo-rs140.2.5-5vulnerable
Debianrust-sudo-rs140.2.9-1vulnerable
Debianrust-sudo-rs140.2.10-1fixed
Ubunturust-sudo-rs25.100.2.4-1vulnerable
Ubunturust-sudo-rs25.100.2.5-3ubuntu1vulnerable
Ubunturust-sudo-rs25.100.2.5-4vulnerable
Ubunturust-sudo-rs25.100.2.5-5vulnerable
Ubunturust-sudo-rs25.100.2.5-5ubuntu1vulnerable
Ubunturust-sudo-rs25.100.2.5-5ubuntu3vulnerable
Ubunturust-sudo-rs25.100.2.8-1ubuntu2vulnerable
Ubunturust-sudo-rs25.100.2.8-1ubuntu3vulnerable
Ubunturust-sudo-rs25.100.2.8-1ubuntu4vulnerable
Ubunturust-sudo-rs25.100.2.8-1ubuntu5vulnerable
Ubunturust-sudo-rs25.100.2.8-1ubuntu5.1vulnerable
Ubunturust-sudo-rs25.100.2.8-1ubuntu5.2fixed
Debianrust-sudo-rs130.2.5-5vulnerable
Debianrust-sudo-rs130.2.5-5+deb13u1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianrust-sudo-rsdeb130.2.5-5+deb13u1Not reportedDEBIAN-CVE-2025-64170Not reported
Debianrust-sudo-rsdeb140.2.10-1Not reportedDEBIAN-CVE-2025-64170Not reported
Ubunturust-sudo-rsdeb25.100.2.8-1ubuntu5.2Not reportedUBUNTU-CVE-2025-64170Not reported
Debianrust-sudo-rsdeb130.2.5-5+deb13u1Not reportedDSA-6052-1Not reported

OpenFactory catalog packages

[Debian 13 (Trixie)]

  • [librust-sudo-rs-dev]Fixed

    Source package: [rust-sudo-rs]

    Details (4)

    • 0.2.5-5+deb13u1 · amd64 · trixie

      Fixed · Fixed: 0.2.5-5+deb13u1

      pypi · rust-sudo-rs · debian · 13

    • 0.2.5-5+deb13u1 · arm64 · trixie

      Fixed · Fixed: 0.2.5-5+deb13u1

      pypi · rust-sudo-rs · debian · 13

    • 0.2.5-5+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 0.2.5-5+deb13u1

      pypi · rust-sudo-rs · debian · 13

    • 0.2.5-5+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 0.2.5-5+deb13u1

      pypi · rust-sudo-rs · debian · 13

  • [sudo-rs]Fixed

    Source package: [rust-sudo-rs]

    Details (4)

    • 0.2.5-5+deb13u1 · amd64 · trixie

      Fixed · Fixed: 0.2.5-5+deb13u1

      pypi · rust-sudo-rs · debian · 13

    • 0.2.5-5+deb13u1 · arm64 · trixie

      Fixed · Fixed: 0.2.5-5+deb13u1

      pypi · rust-sudo-rs · debian · 13

    • 0.2.5-5+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 0.2.5-5+deb13u1

      pypi · rust-sudo-rs · debian · 13

    • 0.2.5-5+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 0.2.5-5+deb13u1

      pypi · rust-sudo-rs · debian · 13

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]