https://bugs.launchpad.net/ubuntu/+source/rust-sudo-rs/+bug/2130623

Log in / Register
[CoF]

Ubuntu
rust-sudo-rs package

  * Overview
  * Code
  * Bugs
  * Blueprints
  * Translations
  * Answers

Update to address two moderate vulnerabilities

Bug #2130623 reported by Simon Johnsson on 2025-11-04
266
This bug affects 1 person

       Affects            Status    Importance Assigned to Milestone
 rust-sudo-rs (Ubuntu) New          Undecided  Unassigned   
 Plucky                New          Undecided  Unassigned   
 Questing              Fix Released Undecided  Unassigned   

Bug Description

PPA with fix: https://launchpad.net/~bamf0/+archive/ubuntu/rust-sudo-
rs-lp2130623/+packages
Repository with fix: https://code.launchpad.net/~bamf0/ubuntu/+source
/cve-fixes/+git/cve-fixes/+ref/sudo-rs-sru-lp2130623-questing
---
Upstream will release a fix for two moderate vulnerabilities
targeting Friday (Nov 7 2025).

The expected coordinated release of this fix is Monday (Nov 10 2025).

One of these vulnerabilities is CVE-2025-64170.

Course of action:
- The change suggested by upstream is to update the package (SRU)
- There are not any changes in dependencies with respect to version
0.2.8

See original description
Tags: patch
Simon Johnsson (bamf0) on 2025-11-04

summary: - Please Fix Bug
         + Update to address two moderate vulnerabilities

Revision history for this message [close]

Simon Johnsson (bamf0) wrote on 2025-11-04 (last edit on           #1
2025-11-04):

We have been in contact with Marc Schoolderman <email address hidden>
from upstream.

Marc Deslauriers <email address hidden> from security has been
notified.

[We have been in cont]                  
[                    ]                  
[Marc Deslauriers <ma]                  
[                    ]                  
[                    ]                  
[                    ]                  
[                    ]                  
[                    ]                  
[                    ]                  
[                    ] [Update] [Cancel]

description:  updated

Simon Johnsson (bamf0) on 2025-11-04

description:  updated

Simon Johnsson (bamf0) on 2025-11-04

description:  updated

Simon Johnsson (bamf0) on 2025-11-04

description:  updated

Revision history for this message [close]

Simon Johnsson (bamf0) wrote on 2025-11-10:   #2

The fixes have been released and I am preparing a security SRU.

[The fixes have been ]                  
[                    ]                  
[                    ]                  
[                    ]                  
[                    ]                  
[                    ]                  
[                    ]                  
[                    ]                  
[                    ]                  
[                    ] [Update] [Cancel]
Revision history for this message [close]

Simon Johnsson (bamf0) wrote on 2025-11-10:   #3

  * lp-2130623-GHSA-c978-wq47-pvvw.patch Edit (12.3 KiB, text/plain)

Here is the preliminary patch for GHSA-c978-wq47-pvvw. Awaiting build
success before forwarding to security.

[Here is the prelimin]                  
[                    ]                  
[                    ]                  
[                    ]                  
[                    ]                  
[                    ]                  
[                    ]                  
[                    ]                  
[                    ]                  
[                    ] [Update] [Cancel]

description:  updated

Revision history for this message [close]

Simon Johnsson (bamf0) wrote on 2025-11-10:   #4

  * lp-2130623-GHSA-q428-6v73-fc4q.patch Edit (28.1 KiB, text/plain)

Here is the preliminary patch for GHSA-q428-6v73-fc4q. Awaiting build
success before forwarding to security.

[Here is the prelimin]                  
[                    ]                  
[                    ]                  
[                    ]                  
[                    ]                  
[                    ]                  
[                    ]                  
[                    ]                  
[                    ]                  
[                    ] [Update] [Cancel]
Revision history for this message [close]

Wesley Hershberger (whershberger) wrote on 2025-11-10:   #5

Hey Simon, thanks for hopping on this. Security uploads have a few
special requirements for changelog entries and should target
`questing-security` instead of `questing` [1].

lp-2130623-GHSA-q428-6v73-fc4q.patch looks good to me.

[1] https://wiki.ubuntu.com/SecurityTeam/UpdatePreparation#Packaging

[Hey Simon, thanks fo]                  
[                    ]                  
[lp-2130623-GHSA-q428]                  
[                    ]                  
[[1] https://wiki.ubu]                  
[                    ]                  
[                    ]                  
[                    ]                  
[                    ]                  
[                    ] [Update] [Cancel]
Revision history for this message [close]

Marc Deslauriers (mdeslaur) wrote on 2025-11-10:   #6

I am preparing the questing security upload in the security team PPA
now.

[I am preparing the q]                  
[                    ]                  
[                    ]                  
[                    ]                  
[                    ]                  
[                    ]                  
[                    ]                  
[                    ]                  
[                    ]                  
[                    ] [Update] [Cancel]
Revision history for this message [close]

Launchpad Janitor (janitor) wrote on 2025-11-10:   #7

This bug was fixed in the package rust-sudo-rs - 0.2.8-1ubuntu5.2

---------------
rust-sudo-rs (0.2.8-1ubuntu5.2) questing-security; urgency=high

  * SECURITY UPDATE: multiple security fixes (LP: #2130623)
    - debian/patches/lp-2130623-GHSA-q428-6v73-fc4q-*.patch
    - debian/patches/lp-2130623-GHSA-c978-wq47-pvvw-*.patch
    - CVE numbers pending

 -- Simon Johnsson <email address hidden> Mon, 10 Nov 2025 16:12:00
+0100

[This bug was fixed i]                  
[                    ]                  
[---------------     ]                  
[rust-sudo-rs (0.2.8-]                  
[                    ]                  
[  * SECURITY UPDATE:]                  
[    - debian/patches]                  
[    - debian/patches]                  
[    - CVE numbers pe]                  
[                    ] [Update] [Cancel]

Changed in rust-sudo-rs (Ubuntu Questing):
status:     New - Fix Released

Revision history for this message [close]

Marc Deslauriers (mdeslaur) wrote on 2025-11-10:   #8

I am making this bug public since the two commits are now in the
upstream repo and listed in the changes file.

[I am making this bug]                  
[                    ]                  
[                    ]                  
[                    ]                  
[                    ]                  
[                    ]                  
[                    ]                  
[                    ]                  
[                    ]                  
[                    ] [Update] [Cancel]

information type: Private Security - Public Security

Revision history for this message [close]

Ubuntu Foundations Team Bug Bot (crichton) wrote 18 hours ago:   #9

The attachment "lp-2130623-GHSA-c978-wq47-pvvw.patch" seems to be a
patch. If it isn't, please remove the "patch" flag from the
attachment, remove the "patch" tag, and if you are a member of the
~ubuntu-reviewers, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by
~brian-murray, for any issues please contact him.]

[The attachment "lp-2]                  
[                    ]                  
[[This is an automate]                  
[                    ]                  
[                    ]                  
[                    ]                  
[                    ]                  
[                    ]                  
[                    ]                  
[                    ] [Update] [Cancel]

tags: added: patch

See full activity log
                 To post a comment you must log in.

  * Report a bug

This report contains Public Security information  
Everyone can see this security related information.

You are not directly subscribed to this bug's notifications.
Subscribing...

  * Edit bug mail

Other bug subscribers

Subscribe someone else

Patches

  * lp-2130623-GHSA-c978-wq47-pvvw.patch Edit
  * lp-2130623-GHSA-q428-6v73-fc4q.patch Edit

  * Add patch

Remote bug watches

Bug watches keep track of this bug in other bug trackers.

Launchpad  *  Take the tour  *  Read the guide  
[                    ] Search Launchpad
(c) 2004 Canonical Ltd.  *  Terms of use  *  Data privacy  *  Contact
Launchpad Support  *  Blog  *  Careers  *  System status  *  1d08ffb
(Get the code!)