CVE-2022-43995 - CVE House
Back to Database
Status published Unknown CVE-2022-43995

Sudo 1.8.0 through 1.9.12, with the crypt() password backend, contains...

Vulnerability Description

Sudo 1.8.0 through 1.9.12, with the crypt() password backend, contains a plugins/sudoers/auth/passwd.c array-out-of-bounds error that can result in a heap-based buffer over-read. This can be triggered by arbitrary local users with access to Sudo by entering a password of seven characters or fewer. The impact could vary depending on the system libraries, compiler, and processor architecture.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-43995

Credits & Attribution

No credits recorded in the NVD database.

References

More from sudo project

View All →
CVE-2021-3156
Sudo before 1.9.5p2 contains an off-by-one error that can result...
Unknown 0
CVE-2021-23240
selinux_edit_copy_tfiles in sudoedit in Sudo before 1.9.5 allows a local...
High 7.8
CVE-2021-23239
The sudoedit personality of Sudo before 1.9.5 may allow a...
Low 2.5
CVE-2019-18684
Sudo through 1.8.29 allows local users to escalate to root...
High 7
CVE-2019-18634
In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers,...
High 7.8

Affected Vendor

sudo project

View all reports →

Affected Software

sudo
Vulnerable Versions:
1.8.0, 1.9.12

Timeline

Official Publish: November 2nd, 2022
Last Modified: May 5th, 2025
Added to House: July 21st, 2026

CVSS Vectors

No vector data available

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.