CVE-2016-7091

Severity
4.4MEDIUM
EPSS
0.1%
top 78.72%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedDec 22
Latest updateMay 17

Description

sudo: It was discovered that the default sudo configuration on Red Hat Enterprise Linux and possibly other Linux implementations preserves the value of INPUTRC which could lead to information disclosure. A local user with sudo access to a restricted program that uses readline could use this flaw to read content from specially formatted files with elevated privileges provided by sudo.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:NExploitability: 0.8 | Impact: 3.6

Patches

🔴Vulnerability Details

2
GHSA
GHSA-4h4j-rqc9-6rq3: sudo: It was discovered that the default sudo configuration on Red Hat Enterprise Linux and possibly other Linux implementations preserves the value o2022-05-17
CVEList
CVE-2016-7091: sudo: It was discovered that the default sudo configuration on Red Hat Enterprise Linux and possibly other Linux implementations preserves the value o2016-12-22

📋Vendor Advisories

2
Red Hat
sudo: Possible info leak via INPUTRC2016-05-24
Debian
CVE-2016-7091: sudo - sudo: It was discovered that the default sudo configuration on Red Hat Enterpris...2016

💬Community

5
Bugzilla
CVE-2016-7091 sudo: readline: Possible info leak via INPUTRC [fedora-all]2016-05-30
Bugzilla
CVE-2016-7091 sudo: Possible info leak via INPUTRC2016-05-26
Bugzilla
CVE-2016-7091 compat-readline5: readline: Possible info leak via INPUTRC [fedora-all]2016-05-26
Bugzilla
CVE-2016-7091 readline: Possible info leak via INPUTRC [fedora-all]2016-05-26
Bugzilla
CVE-2016-7091 mingw-readline: readline: Possible info leak via INPUTRC [fedora-all]2016-05-26
CVE-2016-7091 (MEDIUM CVSS 4.4) | sudo: It was discovered that the de | cvebase.io