Your message dated Mon, 28 Sep 2026 13:05:21 +0000
with message-id <[email protected]>
and subject line Bug#1148890: fixed in sudo 1.9.17p2-9
has caused the Debian Bug report #1148890,
regarding sudo: CVE-2026-96512
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1148890: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1148890
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: sudo
Version: 1.9.17p2-8
Severity: important
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerability was published for sudo.
CVE-2026-96512[0]:
| A flaw was found in sudo. When sudoers rules use NOTBEFORE or
| NOTAFTER time-based access restrictions with timestamps that omit
| the trailing 'Z' timezone indicator, the time evaluation relies on
| the TZ environment variable inherited from the calling user. Because
| sudo is a setuid-root program, an unprivileged local user can set TZ
| to an extreme timezone offset to shift the authorization window by
| up to approximately 25 hours, causing expired rules to be treated as
| valid. This allows the user to execute commands outside the intended
| time window. Authentication is not bypassed; only the time-based
| authorization check is affected.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-96512
https://www.cve.org/CVERecord?id=CVE-2026-96512
[1] https://bugzilla.redhat.com/show_bug.cgi?id=2539327
[2]
https://github.com/sudo-project/sudo/commit/1820a349687522f51023d1ae5925125f59679a8c
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: sudo
Source-Version: 1.9.17p2-9
Done: Marc Haber <[email protected]>
We believe that the bug you reported is fixed in the latest version of
sudo, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Marc Haber <[email protected]> (supplier of updated sudo package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Mon, 28 Sep 2026 14:40:42 +0200
Source: sudo
Architecture: source
Version: 1.9.17p2-9
Distribution: unstable
Urgency: medium
Maintainer: Debian Sudo Maintainers <[email protected]>
Changed-By: Marc Haber <[email protected]>
Closes: 1148890
Changes:
sudo (1.9.17p2-9) unstable; urgency=medium
.
* Apply upstream patches to address CVE-2026-96512.
Thanks to Salvatore Bonaccorso (Closes: #1148890)
* snapshot release
Checksums-Sha1:
39e452ae4eece5750be486821e2d9f944ae94171 3027 sudo_1.9.17p2-9.dsc
acd5fe445abc6d1ef6eb1d62c8dd6edd25f3470f 53368 sudo_1.9.17p2-9.debian.tar.xz
5897c4a4a378507f2cffd0a3d74d2e72acb01d1a 8778164 sudo_1.9.17p2-9.git.tar.xz
b917f840dc834cc5ce8fbde17c21bccfcf5b3e19 17724 sudo_1.9.17p2-9_source.buildinfo
Checksums-Sha256:
00bb7906f77069443e6c6b7e341dc72de330ba3daf272836878ab8330a371c4a 3027
sudo_1.9.17p2-9.dsc
d4d35d95bd3cf0c23fdd301ceef11ec2d51b710a013fab91a6a140e8d713bb1c 53368
sudo_1.9.17p2-9.debian.tar.xz
55f116aa2194d812d11c56ad9c76206ad740f24f214f56c87e65b66dd2276df2 8778164
sudo_1.9.17p2-9.git.tar.xz
121cba4199c6dea55e21e1f36c854d358e4145a123cded2ff76d67c24789c875 17724
sudo_1.9.17p2-9_source.buildinfo
Files:
36c9f3708067a14ec05a37545b5282e9 3027 admin optional sudo_1.9.17p2-9.dsc
a3e35f8c2776eb81a0f09e0004bda321 53368 admin optional
sudo_1.9.17p2-9.debian.tar.xz
fc1c49567b869978a8fd4553e799eefc 8778164 admin None sudo_1.9.17p2-9.git.tar.xz
eac8127bb898a3bc92fbc128cb646541 17724 admin optional
sudo_1.9.17p2-9_source.buildinfo
Git-Tag-Info: tag=a45d8ee126335ee114bf8e48f6e709ed719203b5
fp=6852d7634180aae6088c83ead54d300c376391c9
Git-Tag-Tagger: Marc Haber <[email protected]>
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmq6YV8ACgkQYG0ITkaD
wHn6Ow//T5wim22w5o4NSm0dUXKpESlF7HVP12EQ98XM/rmVS42MWxLGeSWMPG9f
Kmyq++JpcL9ic59bs1PMBxzSXnoXUPMzHKpN8WnBmYgff810lY3LU+MkcybU5cVd
3ujgTOzoukfk/UyAtFpy6FvrCUM4HMUka3iyDT5FGsX1/tZG7XWHydA1P3m9gl9c
T6VPHJ9Mfw8RreQxvta6vWh/ZYMWEWiQtU8pU7qSwWU9aIV1WdDJ5TcIrxtkJ03l
uMOPNW9CpZgEbuRtqKbTCCmPfyWWiRBZTgCq+pn/Qo1I6VqJw1D+9U/2uQ7tbrTd
lerpE7WQYrZ2cByLSRUGHA7sx7gHJq2SpIvbZ8RnXsYgz5oVMpcWteCjsWLzIs/x
ApjR+bO1x7ywUs0/6w4MYCgAf5m4DAk1ajOtf+VWvRgkMAe0OOybZpA9nTPdBBOr
h9EoDnwCpmt4EpvIIKFjqRWtKCXNudJZkGzQUKPmh2/T6B5AH7O7Wh8PKwLbW7js
zGWtMn5dSpG4dFWqMf1wVZPNfHA9vmiEwOG3z4mwjLcqxSao37CjRnQetY7DbJLu
F3WZBjgr/MoRJHp5kKldFU9H41ag6z0O49jo2m0IdEyhGuIpI3zvqTqQ8kRK+b9t
80Z7KyqdQ9wqJiQ4Zrc0Q7tNQ+NwzpqcI7pOq+prHOlyhA72Vzg=
=L+hB
-----END PGP SIGNATURE-----
pgpGpXOI6FMwC.pgp
Description: PGP signature
--- End Message ---
