# CVE-2023-42456: Trifecta Tech Foundation sudo-rs path traversal in session file handling

Source: https://junglewise.ai/threats/cve-2023-42456-trifecta-tech-foundation-sudo-rs-path-traversal-in-session-file  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-09-21. Updated: 2026-06-10  
License: CC BY 4.0 with a link back

CVE-2023-42456 · Severity: low · CVSS 3.3 · Published 2023-09-21

sudo-rs is a memory-safe implementation of the sudo utility used to manage administrative permissions on Linux systems. A vulnerability was found where a user with a specially crafted username containing path characters (like dots and slashes) could trick the system into deleting or corrupting arbitrary files. This could allow an attacker to disable critical system tools or cause a service outage, though it requires the ability to create or log in as a user with an unusual name.

Technologies: [sudo-rs (crates.io)](https://junglewise.ai/threats/technologies/sudo-rs). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io).

## Quick answers

**Is CVE-2023-42456 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-42456 being exploited in the wild.

**How severe is CVE-2023-42456?** Low severity, with a CVSS score of 3.3, published 21 September 2023.

**Which products and versions are affected?** sudo-rs (crates.io) <= 0.2.0, SEMVER:introduced=0,fixed=0.2.1, SEMVER:introduced=0.0.0-0,fixed=0.2.1.

**Is there a fix for CVE-2023-42456?** Yes. sudo-rs (crates.io): upgrade to 0.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-42456 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2023-42456?** Check whether you run sudo-rs (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- sudo-rs (crates.io): upgrade to 0.2.1 or later

  ```sh
  cargo update -p sudo-rs
  ```


## Technical details

A path traversal vulnerability exists in sudo-rs versions 0.2.0 and earlier due to improper neutralization of usernames when constructing session file paths in /var/run/sudo-rs/ts. If an attacker can authenticate as a user with a name containing traversal sequences (e.g., '../../../../bin/cp'), executing 'sudo -K' causes the application to resolve the session file path to an unintended location and attempt to clear it. This results in the corruption or effective removal of the target file. The vulnerability is exploitable on systems like Debian Bookworm or Ubuntu 24.04 that do not strictly validate username characters during account creation. The issue is resolved in version 0.2.1 by using UIDs instead of usernames for session filenames.

## Affected products

- Trifecta Tech Foundation sudo-rs <= 0.2.0

## Identifiers

- CVE-2023-42456
- GHSA-2r3c-m6v7-9354
- RUSTSEC-2023-0069

## Timeline

- 2023-09-21: advisory
- 2023-09-21: disclosed
- 2023-09-21: patched: Fixed in version 0.2.1
- 2026-06-10: other: Advisory updated to reflect lower severity based on username creation restrictions.

## References

- [https://api.github.com/users/rnijveld](https://api.github.com/users/rnijveld)
- [https://github.com/rnijveld](https://github.com/rnijveld)
- [https://api.github.com/users/rnijveld/gists%7B/gist_id%7D](https://api.github.com/users/rnijveld/gists%7B/gist_id%7D)
- [https://api.github.com/users/rnijveld/repos](https://api.github.com/users/rnijveld/repos)
- [https://avatars.githubusercontent.com/u/193783?v=4](https://avatars.githubusercontent.com/u/193783?v=4)
- [https://api.github.com/users/rnijveld/events%7B/privacy%7D](https://api.github.com/users/rnijveld/events%7B/privacy%7D)

## Related threats

- [sudo-rs doesn't record authenticating user properly in timestamp](https://junglewise.ai/threats/cve-2025-64517-sudo-rs-doesn-t-record-authenticating-user-properly-in-timestamp)
- [sudo-rs: Partial password reveal is possible after timeout](https://junglewise.ai/threats/cve-2025-64170-sudo-rs-partial-password-reveal-is-possible-after-timeout)
- [sudo-rs Allows Low Privilege Users to Enumerate Privileges of Others](https://junglewise.ai/threats/cve-2025-46718-sudo-rs-allows-low-privilege-users-to-enumerate-privileges-of)
- [sudo-rs Allows Low Privilege Users to Discover the Existence of Files in Inaccessible Folders](https://junglewise.ai/threats/cve-2025-46717-sudo-rs-allows-low-privilege-users-to-discover-the-existence-of)