Security issues discovered in sudo-rs

[portmanteaufu]

To save everyone a click, the text is:

""" Two security issues were discovered in sudo-rs, a Rust-based implemention of sudo (and su), which could result in the local disclosure of partially typed passwords or an authentication bypass in some targetpw/rootpw configurations.

For the stable distribution (trixie), this problem has been fixed in version 0.2.5-5+deb13u1.

We recommend that you upgrade your rust-sudo-rs packages. """

[wiz21c]

as far as i can see, it's just programming errors, nothing to do with rust.

[_flux]

Everything to do with reimplementing sudo, though.

But sudo has its share of CVEs as well (latest CVE-2025-32463), so perhaps a fresh look on the tool is warranted; perhaps some learnings have been taken from it.

[never_inline]

Do they have test suite comparable to that of original sudo, or can they reuse the test suite of original sudo?

[egorfine]

Same could be said about many of the real sudo bugs, but that argument doesn't stick with rust fanboys.

(Obligatory disclaimer: I love rust, I hate fanboys and rewrites)

[_flux]

What were the actual fixes like?

[thw_9a83c]

There is a link to github commit in the "Notes" section for each CVE [1].

[1]: https://security-tracker.debian.org/tracker/source-package/r...

[m4rtink]

But memory safety!