Critical Security Update for sudo Package: DSA-5954-1
Summary
DSA-5954-1: sudo - security update. Affects sudo versions < 1.9.13p3-1+deb12u2. Fixed in 1.9.13p3-1+deb12u2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The sudo package is a widely used utility in Unix-like operating systems that allows a permitted user to execute a command as the superuser or another user, as specified by the security policy. It is essential for system administration and security management. The package is integral to maintaining system integrity and user permissions. However, vulnerabilities in sudo can lead to unauthorized access and privilege escalation, posing significant risks to system security.
Vulnerability Detail
The vulnerability identified as CVE-2025-32462 affects the sudo package, allowing attackers to exploit a flaw that could lead to unauthorized command execution with elevated privileges. This vulnerability arises from improper handling of certain input parameters, which could be manipulated by an attacker to gain access to restricted system functions. The ramifications of this vulnerability are severe, as it could allow malicious users to execute arbitrary commands, potentially compromising the entire system.
How To Fix
Minimum fixed version
1.9.13p3-1+deb12u2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade sudoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the sudo command by modifying the sudoers file to limit which users can execute commands with sudo privileges. This can be done by editing the file with 'visudo' and ensuring that only trusted users are granted sudo access.
Conclusion
The sudo package vulnerability CVE-2025-32462 poses a significant risk to system security, allowing unauthorized command execution. Users are strongly advised to update to the patched version to mitigate this risk. Implementing temporary workarounds can provide additional security until the update is applied.
See every vulnerability recorded for sudo →
FAQ
CVE-2025-32462 can lead to unauthorized command execution, allowing attackers to gain elevated privileges and potentially compromise the system.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, consider restricting sudo access to trusted users as a temporary measure.
Regularly check for vulnerabilities, ideally on a weekly basis, to ensure your software remains secure and up-to-date.
Vulert monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json, providing real-time insights into potential risks.
Related vulnerabilities
Recent vulnerabilities recorded for sudo.
