Executive Summary

This vulnerability occurs in sudo-rs versions 0.2.7 to before 0.2.10, where if a user starts typing a password but does not press return for a long time, a password timeout triggers. When this happens, the keystrokes entered so far are echoed back to the console, potentially revealing partial password information. This exposure could lead to password leakage through screen observation or history files if not carefully handled.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can expose partial password information to anyone who can see the console or access history files, increasing the risk of password compromise. This could enable attackers to use social engineering or pass-by attacks to gain unauthorized access.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade sudo-rs to version 0.2.10 or later, as this version fixes the password timeout issue that causes keystrokes to be echoed back to the console. Until the upgrade, avoid leaving password prompts open without pressing return to prevent partial password exposure.

Useful 0 Not Useful 0