According to the versions of the sudo package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Sudo before 1.9.13 does not escape control characters in log messages. (CVE-2023-28486)

  - Sudo before 1.9.13 does not escape control characters in sudoreplay output. (CVE-2023-28487)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-0811 advisory.

    - CVE-2023-28487 sudo: Sudo does not escape control characters in sudoreplay output     Resolves: RHEL-21834
    - CVE-2023-28486 sudo: Sudo does not escape control characters in log messages     Resolves: RHEL-21828
    - CVE-2023-42465 sudo: Targeted Corruption of Register and Stack Variables     Resolves: RHEL-21821

    RHEL 8.9.0.Z ERRATUM
    - CVE-2023-28486 sudo: Sudo does not escape control characters in log messages     Resolves: RHEL-21825
    - CVE-2023-28487 sudo: Sudo does not escape control characters in sudoreplay output     Resolves: RHEL-21831

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202309-12 (sudo: Multiple Vulnerabilities)

  - Sudo before 1.9.13p2 has a double free in the per-command chroot feature. (CVE-2023-27320)

  - Sudo before 1.9.13 does not escape control characters in log messages. (CVE-2023-28486)

  - Sudo before 1.9.13 does not escape control characters in sudoreplay output. (CVE-2023-28487)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-135 advisory.

    Sudo before 1.9.13 does not escape control characters in log messages. (CVE-2023-28486)

    Sudo before 1.9.13 does not escape control characters in sudoreplay output. (CVE-2023-28487)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6005-1 advisory.

    Matthieu Barjole and Victor Cutillas discovered that Sudo incorrectly escaped control characters in log     messages and sudoreplay output. An attacker could possibly use these issues to inject terminal control     characters that alter output when being viewed.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the sudo package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    Sudo before 1.9.13 does not escape control characters in sudoreplay output.(CVE-2023-28487)

    Sudo before 1.9.13 does not escape control characters in log messages.(CVE-2023-28486)

Tenable has extracted the preceding description block directly from the EulerOS sudo security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the sudo package has been released.

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0969 advisory.

    This advisory aggregates security fixes for the sudo SRPM in CIQ LTS 9.2. It addresses 3 CVEs:
    CVE-2023-28486, CVE-2023-42465, CVE-2023-28487.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
189060	EulerOS 2.0 SP11 : sudo (EulerOS-SA-2023-2670)	Nessus	Huawei Local Security Checks	1/16/2024	2/8/2024	medium
190536	Oracle Linux 8 / 9 : sudo (ELSA-2024-0811)	Nessus	Oracle Linux Local Security Checks	2/14/2024	1/21/2026	high
182195	GLSA-202309-12 : sudo: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	9/29/2023	9/29/2023	high
173336	Amazon Linux 2023 : sudo, sudo-devel, sudo-logsrvd (ALAS2023-2023-135)	Nessus	Amazon Linux Local Security Checks	3/23/2023	9/9/2025	medium
174161	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : Sudo vulnerabilities (USN-6005-1)	Nessus	Ubuntu Local Security Checks	4/12/2023	8/27/2024	medium
207617	EulerOS 2.0 SP8 : sudo (EulerOS-SA-2024-2493)	Nessus	Huawei Local Security Checks	9/24/2024	9/24/2024	medium
204687	Photon OS 3.0: Sudo PHSA-2023-3.0-0627	Nessus	PhotonOS Local Security Checks	7/25/2024	7/25/2024	medium
204309	Photon OS 4.0: Sudo PHSA-2023-4.0-0446	Nessus	PhotonOS Local Security Checks	7/24/2024	7/24/2024	medium
356870	Rocky Linux 9.2 [CIQ] Security Update: sudo / sudo-debuginfo / sudo-debugsource / sudo-devel / etc Multiple Vulnerabilities (ciqsa-2026_0969)	Nessus	Rocky Linux Local Security Checks	10/1/2026	10/12/2026	high

Detections

Analytics

Plugins Search

medium

high

high

medium

medium

medium

medium

medium

high