{"id":"CVE-2025-64170","aliases":["GHSA-c978-wq47-pvvw"],"url":"https://o3.security/vulnerability/CVE-2025-64170","summary":"sudo-rs: Partial password reveal is possible after timeout","details":"### Summary\nIf a user begins entering a password but does not press return for an extended period, a password timeout may occur. When this happens, the keystrokes that were entered are echoed back to the console.\n\n### Example\nUsing sudo-rs:\n```\ngeiger@cerberus:~$ sudo -s\n[sudo: authenticate] Password: sudo-rs: timed out\ngeiger@cerberus:~$ testtesttest\n```\n\n\"testtesttest\" was entered at the password prompt but not confirmed by pressing return and then waiting for the timeout.\n\n### Impact\nThis could reveal partial password information, possibly exposing history files when not carefully handled by the user and on screen, usable for Social Engineering or Pass-By attacks.\n\n### Versions affected\nPasswords timeouts were added in sudo-rs 0.2.7 (with a default set to 5 minutes).\n\n### Credits\nThis issue was discovered and reported by @DevLaTron.","published":"2025-11-12T20:30:14.961Z","modified":"2026-08-12T03:51:12.722814974Z","cvss":{"score":3.8,"severity":"LOW","vector":"CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"crates.io","name":"sudo-rs","fixedVersion":"0.2.10"}],"fix":{"url":"https://github.com/trifectatechfoundation/sudo-rs/commit/0e3d3837aec3ee9fb5dcb8bfe11e8adb367f58f4","label":"trifectatechfoundation/sudo-rs@0e3d383"},"references":[{"type":"WEB","url":"https://github.com/trifectatechfoundation/sudo-rs/releases/tag/v0.2.10"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64170.json"},{"type":"ADVISORY","url":"https://github.com/trifectatechfoundation/sudo-rs/security/advisories/GHSA-c978-wq47-pvvw"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-64170"},{"type":"WEB","url":"https://github.com/trifectatechfoundation/sudo-rs/commit/0e3d3837aec3ee9fb5dcb8bfe11e8adb367f58f4"},{"type":"PACKAGE","url":"https://github.com/trifectatechfoundation/sudo-rs"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:12.722814974Z"}}