{"id":"GHSA-c978-wq47-pvvw","summary":"sudo-rs: Partial password reveal is possible after timeout","details":"### Summary\nIf a user begins entering a password but does not press return for an extended period, a password timeout may occur. When this happens, the keystrokes that were entered are echoed back to the console.\n\n### Example\nUsing sudo-rs:\n```\ngeiger@cerberus:~$ sudo -s\n[sudo: authenticate] Password: sudo-rs: timed out\ngeiger@cerberus:~$ testtesttest\n```\n\n\"testtesttest\" was entered at the password prompt but not confirmed by pressing return and then waiting for the timeout.\n\n### Impact\nThis could reveal partial password information, possibly exposing history files when not carefully handled by the user and on screen, usable for Social Engineering or Pass-By attacks.\n\n### Versions affected\nPasswords timeouts were added in sudo-rs 0.2.7 (with a default set to 5 minutes).\n\n### Credits\nThis issue was discovered and reported by @DevLaTron.","aliases":["CVE-2025-64170"],"modified":"2025-11-15T03:13:07Z","published":"2025-11-12T21:30:11Z","database_specific":{"nvd_published_at":"2025-11-12T21:15:53Z","cwe_ids":["CWE-549"],"severity":"LOW","github_reviewed":true,"github_reviewed_at":"2025-11-12T21:30:11Z"},"references":[{"type":"WEB","url":"https://github.com/trifectatechfoundation/sudo-rs/security/advisories/GHSA-c978-wq47-pvvw"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-64170"},{"type":"WEB","url":"https://github.com/trifectatechfoundation/sudo-rs/commit/0e3d3837aec3ee9fb5dcb8bfe11e8adb367f58f4"},{"type":"PACKAGE","url":"https://github.com/trifectatechfoundation/sudo-rs"},{"type":"WEB","url":"https://github.com/trifectatechfoundation/sudo-rs/releases/tag/v0.2.10"}],"affected":[{"package":{"name":"sudo-rs","ecosystem":"crates.io","purl":"pkg:cargo/sudo-rs"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.2.7"},{"fixed":"0.2.10"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/11/GHSA-c978-wq47-pvvw/GHSA-c978-wq47-pvvw.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N"}]}