{"id":"USN-8708-2","summary":"rust-sudo-rs vulnerability","details":"USN-8708-1 fixed a vulnerability in sudo-rs. This update provides the\ncorresponding fix for Ubuntu 26.10.\n\nOriginal advisory details:\n\n It was discovered that sudo-rs incorrectly handled time-of-check vs time-\nof-use conditions in sudoedit. A local attacker with permission to edit\nspecific files using sudoedit could use this issue to place files in\narbitrary directories, and possibly escalate their privileges. This issue\nonly affected systems configured to grant fine-grained sudoedit file\nediting permissions, which is not the default configuration.","modified":"2026-10-20T22:45:06.483291498Z","published":"2026-10-20T14:23:39Z","references":[{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-8708-2"},{"type":"REPORT","url":"https://bugs.launchpad.net/bugs/2165142"}],"affected":[{"package":{"name":"rust-sudo-rs","ecosystem":"Ubuntu:26.10","purl":"pkg:deb/ubuntu/rust-sudo-rs?arch=source&distro=stonking"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.14-1ubuntu4.1"}]}],"versions":["0.2.13-0ubuntu1","0.2.14-1ubuntu2","0.2.14-1ubuntu4"],"ecosystem_specific":{"binaries":[{"binary_name":"sudo-rs","binary_version":"0.2.14-1ubuntu4.1"}],"availability":"No subscription required"},"database_specific":{"cves_map":{"cves":[],"ecosystem":"Ubuntu:26.10"},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8708-2.json"}}],"schema_version":"1.9.0"}