Security Issues Discovered in Sudo-Rs
Postedabout 2 months agoActiveabout 2 months ago
lists.debian.orgTechstory
calmmixed
Debate
60/100
Sudo-RsRustSecurity Vulnerabilities
Key topics
Sudo-Rs
Rust
Security Vulnerabilities
Security issues were discovered in sudo-rs, a Rust-based implementation of sudo, prompting discussion on the role of Rust in preventing memory safety issues.
Snapshot generated from the HN discussion
Discussion Activity
Moderate engagementFirst comment
13m
Peak period
6
0-2h
Avg / period
3
Comment distribution15 data points
Loading chart...
Based on 15 loaded comments
Key moments
- 01Story posted
Nov 12, 2025 at 5:08 AM EST
about 2 months ago
Step 01 - 02First comment
Nov 12, 2025 at 5:21 AM EST
13m after posting
Step 02 - 03Peak activity
6 comments in 0-2h
Hottest window of the conversation
Step 03 - 04Latest activity
Nov 13, 2025 at 1:36 AM EST
about 2 months ago
Step 04
Generating AI Summary...
Analyzing up to 500 comments to identify key contributors and discussion patterns
ID: 45898377Type: storyLast synced: 11/20/2025, 12:47:39 PM
Want the full context?
Jump to the original sources
Read the primary article or dive into the live Hacker News thread when you're ready.
But sudo has its share of CVEs as well (latest CVE-2025-32463), so perhaps a fresh look on the tool is warranted; perhaps some learnings have been taken from it.
[1]: https://man.openbsd.org/doas.1
(Obligatory disclaimer: I love rust, I hate fanboys and rewrites)
[1]: https://security-tracker.debian.org/tracker/source-package/r...
Maybe model checkers could be used, but perhaps the search space is too large for all the featuers, and keeping the source in sync with the model could be quite fragile. And who knows, maybe the model would have the same issue.
""" Two security issues were discovered in sudo-rs, a Rust-based implemention of sudo (and su), which could result in the local disclosure of partially typed passwords or an authentication bypass in some targetpw/rootpw configurations.
For the stable distribution (trixie), this problem has been fixed in version 0.2.5-5+deb13u1.
We recommend that you upgrade your rust-sudo-rs packages. """