# CVE-2025-64517: sudo-rs doesn't record authenticating user properly in timestamp

Source: https://junglewise.ai/threats/cve-2025-64517-sudo-rs-doesn-t-record-authenticating-user-properly-in-timestamp  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-11-12  
License: CC BY 4.0 with a link back

CVE-2025-64517 · Severity: medium · CVSS 4.4 · Published 2025-11-12

sudo-rs is a memory safe implementation of sudo and su written in Rust. With `Defaults targetpw` (or `Defaults rootpw`) enabled,  the password of the target account (or root account) instead of the invoking user is used for authentication. sudo-rs starting in version 0.2.5 and prior to version 0.2.10 incorrectly recorded the invoking user’s UID instead of the authenticated-as user's UID in the authentication timestamp. Any later `sudo` invocation on the same terminal while the timestamp was still valid would use that timestamp, potentially bypassing new authentication even if the policy would have required it. A highly-privileged user (able to run commands as other users, or as root, through sudo) who knows one password of an account they are allowed to run commands as, would be able to run commands as any other account the policy permits them to run commands for, even if they don't know the password for those accounts. A common instance of this would be that a user can still use their own password to run commands as root (the default behaviour of `sudo`), effectively negating the intended behaviour of the `targetpw` or `rootpw` options. Version 0.2.10 contains a patch for the issue. Versions prior to 0.2.5 are not affected, since they do not offer `Defaults targetpw` or `Defaults rootpw`.

Technologies: [sudo-rs (crates.io)](https://junglewise.ai/threats/technologies/sudo-rs). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io).

## Quick answers

**Is CVE-2025-64517 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-64517 being exploited in the wild.

**How severe is CVE-2025-64517?** Medium severity, with a CVSS score of 4.4, published 12 November 2025.

**Which products and versions are affected?** sudo-rs (crates.io) SEMVER:introduced=0.2.5,fixed=0.2.10.

**Is there a fix for CVE-2025-64517?** Yes. sudo-rs (crates.io): upgrade to 0.2.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2025-64517?** Check whether you run sudo-rs (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- sudo-rs (crates.io): upgrade to 0.2.10 or later

  ```sh
  cargo update -p sudo-rs
  ```


## Affected products

- sudo-rs (crates.io) SEMVER:introduced=0.2.5,fixed=0.2.10

## Identifiers

- CVE-2025-64517
- GHSA-q428-6v73-fc4q

## Related threats

- [sudo-rs: Partial password reveal is possible after timeout](https://junglewise.ai/threats/cve-2025-64170-sudo-rs-partial-password-reveal-is-possible-after-timeout)
- [sudo-rs Allows Low Privilege Users to Enumerate Privileges of Others](https://junglewise.ai/threats/cve-2025-46718-sudo-rs-allows-low-privilege-users-to-enumerate-privileges-of)
- [sudo-rs Allows Low Privilege Users to Discover the Existence of Files in Inaccessible Folders](https://junglewise.ai/threats/cve-2025-46717-sudo-rs-allows-low-privilege-users-to-discover-the-existence-of)
- [Trifecta Tech Foundation sudo-rs path traversal in session file handling](https://junglewise.ai/threats/cve-2023-42456-trifecta-tech-foundation-sudo-rs-path-traversal-in-session-file)