Hi, On Thu, Sep 24, 2026 at 08:20:30PM +0200, Salvatore Bonaccorso wrote: > Source: sudo > Version: 1.9.17p2-8 > Severity: important > Tags: security upstream > X-Debbugs-Cc: [email protected], Debian Security Team > <[email protected]> > > Hi, > > The following vulnerability was published for sudo. > > CVE-2026-96512[0]: > | A flaw was found in sudo. When sudoers rules use NOTBEFORE or > | NOTAFTER time-based access restrictions with timestamps that omit > | the trailing 'Z' timezone indicator, the time evaluation relies on > | the TZ environment variable inherited from the calling user. Because > | sudo is a setuid-root program, an unprivileged local user can set TZ > | to an extreme timezone offset to shift the authorization window by > | up to approximately 25 hours, causing expired rules to be treated as > | valid. This allows the user to execute commands outside the intended > | time window. Authentication is not bypassed; only the time-based > | authorization check is affected.
Some additional background on this issue in https://www.openwall.com/lists/oss-security/2026/09/24/4 . There is a first part of the fix by an another reporter, which is https://github.com/sudo-project/sudo/commit/db669167ca599f2a94cd8a4c5fae9e473c81a2fd So both commits are needed to address the TZ related issue. Regards, Salvatore
