Read the docs
TI-2023-08978 Aliases CVE-2023-22809GHSA-3vwp-294x-6v9c

In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed…

Priority HIGH 69CWE-269Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-269.

Summary

In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to append arbitrary entries to the list of files to process. This can lead to privilege escalation. Affected versions are 1.8.0 through 1.9.12.p1. The problem exists because a user-specified editor may contain a "--" argument that defeats a protection mechanism, e.g., an EDITOR='vim -- /path/to/extra/file' value.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.55367 99th percentileScored 2026-11-07
Public exploit Yes 3 exploit referencesTagged by NVD
Fix Fixed Red Hat: 13 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:*1.8.0 to before 1.9.12VulnerableSudo project
cpe:2.3:a:sudo_project:sudo:1.9.12:-:*:*:*:*:*:*1.9.12VulnerableSudo project
cpe:2.3:a:sudo_project:sudo:1.9.12:p1:*:*:*:*:*:*1.9.12 p1VulnerableSudo project
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*11.0VulnerableDebian
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*36VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*37VulnerableFedoraproject
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*before 13.4VulnerableApple
  • cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:* Versions 1.8.0 to before 1.9.12 Vulnerable ·Sudo project
  • cpe:2.3:a:sudo_project:sudo:1.9.12:-:*:*:*:*:*:* Versions 1.9.12 Vulnerable ·Sudo project
  • cpe:2.3:a:sudo_project:sudo:1.9.12:p1:*:*:*:*:*:* Versions 1.9.12 p1 Vulnerable ·Sudo project
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
  • cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* Versions 36 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* Versions 37 Vulnerable ·Fedoraproject
  • cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* Versions before 13.4 Vulnerable ·Apple

Remediation

Red Hat 13 advisories

  • RHSA-2023:3276 Released 2023-05-23 · Red Hat rating Important
    sudo security update
    • Red Hat Enterprise Linux Server AUS (v. 7.7) sudo-1.8.23-4.el7_7.4
    • Red Hat Enterprise Linux Server E4S (v. 7.7) sudo-1.8.23-4.el7_7.4
    • Red Hat Enterprise Linux Server Optional AUS (v. 7.7) sudo-devel-1.8.23-4.el7_7.4
    • Red Hat Enterprise Linux Server Optional E4S (v. 7.7) sudo-devel-1.8.23-4.el7_7.4
    • Red Hat Enterprise Linux Server Optional TUS (v. 7.7) sudo-devel-1.8.23-4.el7_7.4
    • Red Hat Enterprise Linux Server TUS (v. 7.7) sudo-1.8.23-4.el7_7.4
  • RHSA-2023:3262 Released 2023-05-23 · Red Hat rating Important
    sudo security update
    • Red Hat Enterprise Linux Server AUS (v. 7.6) sudo-1.8.23-3.el7_6.3
    • Red Hat Enterprise Linux Server Optional AUS (v. 7.6) sudo-devel-1.8.23-3.el7_6.3
  • RHSA-2023:3264 Released 2023-05-23 · Red Hat rating Important
    sudo security update
    • Red Hat Enterprise Linux Server AUS (v. 7.4) sudo-1.8.19p2-12.el7_4.3
    • Red Hat Enterprise Linux Server Optional AUS (v. 7.4) sudo-devel-1.8.19p2-12.el7_4.3
Show 10 more Red Hat advisories
  • RHSA-2023:0859 Released 2023-02-21 · Red Hat rating Important
    Red Hat Virtualization Host 4.4.z SP 1 security update batch#4 (oVirt-4.5.3-4)
    • Red Hat Virtualization 4 Hypervisor for RHEL 8 redhat-virtualization-host-4.5.3-202302150956_8.6, redhat-virtualization-host-image-update-4.5.3-202302150956_8.6
  • RHSA-2023:0293 Released 2023-01-23 · Red Hat rating Important
    sudo security update
    • Red Hat Enterprise Linux BaseOS EUS (v.8.4) sudo-1.8.29-7.el8_4.2
  • RHSA-2023:0291 Released 2023-01-23 · Red Hat rating Important
    sudo security update
    • Red Hat Enterprise Linux Client (v. 7) sudo-1.8.23-10.el7_9.3
    • Red Hat Enterprise Linux Client Optional (v. 7) sudo-devel-1.8.23-10.el7_9.3
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) sudo-devel-1.8.23-10.el7_9.3
    • Red Hat Enterprise Linux Server (v. 7) sudo-1.8.23-10.el7_9.3
    • Red Hat Enterprise Linux Server Optional (v. 7) sudo-devel-1.8.23-10.el7_9.3, sudo-devel-1.8.23-10.el7_9.3.ppc
    • Red Hat Enterprise Linux Workstation (v. 7) sudo-1.8.23-10.el7_9.3
    • Red Hat Enterprise Linux Workstation Optional (v. 7) sudo-devel-1.8.23-10.el7_9.3
  • RHSA-2023:0287 Released 2023-01-23 · Red Hat rating Important
    sudo security update
    • Red Hat Enterprise Linux Server (v. 6 ELS) sudo-1.8.6p3-29.el6_10.7
    • Red Hat Enterprise Linux Server Optional (v. 6 ELS) sudo-devel-1.8.6p3-29.el6_10.7
  • RHSA-2023:0292 Released 2023-01-23 · Red Hat rating Important
    sudo security update
    • Red Hat Enterprise Linux BaseOS AUS (v. 8.2) sudo-1.8.29-5.el8_2.2
    • Red Hat Enterprise Linux BaseOS E4S (v. 8.2) sudo-1.8.29-5.el8_2.2
    • Red Hat Enterprise Linux BaseOS TUS (v. 8.2) sudo-1.8.29-5.el8_2.2
  • RHSA-2023:0283 Released 2023-01-23 · Red Hat rating Important
    sudo security update
    • Red Hat Enterprise Linux BaseOS EUS (v.8.6) sudo-1.8.29-8.el8_6.1
  • RHSA-2023:0284 Released 2023-01-23 · Red Hat rating Important
    sudo security update
    • Red Hat Enterprise Linux BaseOS (v. 8) sudo-1.8.29-8.el8_7.1
  • RHSA-2023:0281 Released 2023-01-23 · Red Hat rating Important
    sudo security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.0) sudo-python-plugin-1.9.5p2-7.el9_0.2
    • Red Hat Enterprise Linux BaseOS EUS (v.9.0) sudo-1.9.5p2-7.el9_0.2
  • RHSA-2023:0282 Released 2023-01-23 · Red Hat rating Important
    sudo security update
    • Red Hat Enterprise Linux AppStream (v. 9) sudo-python-plugin-1.9.5p2-7.el9_1.1
    • Red Hat Enterprise Linux BaseOS (v. 9) sudo-1.9.5p2-7.el9_1.1
  • RHSA-2023:0280 Released 2023-01-23 · Red Hat rating Important
    sudo security update
    • Red Hat Enterprise Linux BaseOS E4S (v. 8.1) sudo-1.8.25p1-8.el8_1.3

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2023:0282
Red Hat Enterprise Linux AppStream EUS (v.9.0)Fixed RHSA-2023:0281
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2023:0284
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2023:0282
Red Hat Enterprise Linux BaseOS AUS (v. 8.2)Fixed RHSA-2023:0292
Red Hat Enterprise Linux BaseOS E4S (v. 8.1)Fixed RHSA-2023:0280
Red Hat Enterprise Linux BaseOS E4S (v. 8.2)Fixed RHSA-2023:0292
Red Hat Enterprise Linux BaseOS EUS (v.8.4)Fixed RHSA-2023:0293
Red Hat Enterprise Linux BaseOS EUS (v.8.6)Fixed RHSA-2023:0283
Red Hat Enterprise Linux BaseOS EUS (v.9.0)Fixed RHSA-2023:0281
Red Hat Enterprise Linux BaseOS TUS (v. 8.2)Fixed RHSA-2023:0292
Red Hat Enterprise Linux Client (v. 7)Fixed RHSA-2023:0291
Red Hat Enterprise Linux Client Optional (v. 7)Fixed RHSA-2023:0291
Red Hat Enterprise Linux ComputeNode Optional (v. 7)Fixed RHSA-2023:0291
Red Hat Enterprise Linux Server (v. 6 ELS)Fixed RHSA-2023:0287
Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2023:0291
Red Hat Enterprise Linux Server AUS (v. 7.4)Fixed RHSA-2023:3264
Red Hat Enterprise Linux Server AUS (v. 7.6)Fixed RHSA-2023:3262
Red Hat Enterprise Linux Server AUS (v. 7.7)Fixed RHSA-2023:3276
Red Hat Enterprise Linux Server E4S (v. 7.7)Fixed RHSA-2023:3276
Red Hat Enterprise Linux Server Optional (v. 6 ELS)Fixed RHSA-2023:0287
Red Hat Enterprise Linux Server Optional (v. 7)Fixed RHSA-2023:0291
Red Hat Enterprise Linux Server Optional AUS (v. 7.4)Fixed RHSA-2023:3264
Red Hat Enterprise Linux Server Optional AUS (v. 7.6)Fixed RHSA-2023:3262
Red Hat Enterprise Linux Server Optional AUS (v. 7.7)Fixed RHSA-2023:3276
Red Hat Enterprise Linux Server Optional E4S (v. 7.7)Fixed RHSA-2023:3276
Red Hat Enterprise Linux Server Optional TUS (v. 7.7)Fixed RHSA-2023:3276
Red Hat Enterprise Linux Server TUS (v. 7.7)Fixed RHSA-2023:3276
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2023:0291
Red Hat Enterprise Linux Workstation Optional (v. 7)Fixed RHSA-2023:0291
Red Hat Virtualization 4 Hypervisor for RHEL 8Fixed RHSA-2023:0859
Not affected: 1 product
  • RHEL 8-based RHEV-H for RHEV 4 (build requirements)

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-22809
  2. 2026-10-03 Alias added: GHSA-3vwp-294x-6v9c

References

Exploit 3

Advisory 11

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences