SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2005-4158

Sudo before 1.6.8 p12, when the Perl taint flag is off, does not clear the (1) PERLLIB, (2) PERL5LIB, and (3) PERL5OPT environment variables, which allows limited local users to cause a Perl script to include and execute arbitrary library files that…

MEDIUM 4.6EPSS 1.08%

Does this matter?

Lower severity and a low EPSS score (1.08%). Track it; it rarely justifies an emergency change on its own.

Description

Sudo before 1.6.8 p12, when the Perl taint flag is off, does not clear the (1) PERLLIB, (2) PERL5LIB, and (3) PERL5OPT environment variables, which allows limited local users to cause a Perl script to include and execute arbitrary library files that have the same name as library files that are included by the script.

CVSS 2.0
4.6 MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P
EPSS
1.08% probability · 63th percentile
CISA KEV
Not listed
Affected
todd miller/sudo
Source
cve@mitre.org

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.