Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2017-1000368

27
FAUCET Score

CVE-2017-1000368 is an input validation vulnerability affecting sudo versions 1.8.20p1 and earlier, specifically within the get_process_ttyname() function due to embedded newlines. This flaw allows a highly privileged local attacker to achieve information disclosure and command execution. With a CVSS score of 8.2 (HIGH), the vulnerability has a high impact on confidentiality, integrity, and availability, requiring local access and high privileges to exploit. There is currently no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB, and it has garnered minimal community discussion or media coverage.

Impacted Technologies

VendorProductVersion(s)CPE
<= 1.8.20CPE matchmatch criteria
cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:*
1.8.20CPE matchmatch criteria
cpe:2.3:a:sudo_project:sudo:1.8.20:p1:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.0

8.2HIGH

CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
1.5
Impact Score
6.0
CvssVersion
3.0

Exploit Intelligence

EPSS Score
0.57%
Probability of exploitation in next 30 days
EPSS Percentile
43.9%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0057 is in the 88th percentile among its peer group of 360 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (3)

redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 5 Extended Lifecycle SupportFixed in: sudo-0:1.7.2p1-31.el5_11
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 6Fixed in: sudo-0:1.8.6p3-29.el6_9
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: sudo-0:1.8.6p7-23.el7_3
View patch

Vendor Advisories (1)

redhatCVE-2017-1000368Moderate

sudo: Privilege escalation via improper get_process_ttyname() parsing (insufficient fix for CVE-2017-1000367)

Jun 2, 2017

References

access.redhat.com / errata/RHSA-2017:1574
Third Party Advisory
kc.mcafee.com / corporate/index
Third Party Advisory
security.gentoo.org / glsa/201710-04
Third Party Advisory
usn.ubuntu.com / 3968-1
usn.ubuntu.com / 3968-2
sudo.ws / alerts/linux_tty.html
Vendor Advisory
securityfocus.com / bid/98838
Third Party AdvisoryVDB Entry