3 ms·
> Recently a Rust sudo replacement (maybe this one?) got a security audit. It is the same one. It's weird because, this article is from August. But the one you
by steveklabnik 3y ago
> Recently a Rust sudo replacement (maybe this one?) got a security audit.
It is the same one. It's weird because, this article is from August. But the one you're referencing is from three days ago: https://ferrous-systems.com/blog/sudo-rs-audit/ https://ferrous-systems.com/blog/sudo-rs-audit/
> the severity was worse in the Rust version.
I am unsure where you got this. It's the same vulnerability.
- db-interface 3y agoThe link you cite says it was worse in the Rust version: > During the audit, it came to light that the original sudo implementation was also affected by [CLN-001: relative path traversal vulnerability], although with a lower security severity due to their use of the openat function.
- jwilk 3y agoI don't see how openat() would help.
- steveklabnik 3y agoThank you. I literally re-read it to try and find this, and missed it somehow. Guess I need to drink even more coffee.
- scns 3y ago> Guess I need to drink even more coffee. Have you tried green tea? It contains a substance that offsets the sideeffects of caffeine a little. https://en.wikipedia.org/wiki/Theanine?wprov=sfla1 https://en.wikipedia.org/wiki/Theanine?wprov=sfla1 Disclaimer: Zero Caffeine for me either way. Makes my ADD way worse. Theanine was nice though. Okay i lied, i allow myself dark chocolate sometimes.
- jwilk 3y agoThe audit discussed on HN: https://news.ycombinator.com/item?id=38131442 https://news.ycombinator.com/item?id=38131442
- das_keyboard 3y agoRe: I am unsure where you got this. It's the same vulnerability. > During the audit, it came to light that the original sudo implementation was also affected by this issue, although with a lower security severity due to their use of the openat function.