> ## Content Index
> Fetch the complete content index at: https://itsfoss.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Ubuntu's Rust Transition Hits Another Bump as sudo-rs Security Vulnerabilities Show Up
- URL: https://itsfoss.com/news/sudo-rs-issue-ubuntu/
- Published: 2025-11-12T13:29:24.000Z
- Updated: 2025-11-15T07:01:07.000Z
- Description: Password exposure and improper authentication validation issues caught early ahead of the LTS release.
- Author: Sourav Rudra
- Tags: News

Ubuntu's move to Rust-based system utilities has hit some bumps. Earlier, a bug in the Rust-based date command [broke automatic updates](https://itsfoss.com/news/ubuntu-25-10-rust-automatic-upgrade-bug/). The command returned current time instead of file modification timestamps, causing Ubuntu 25.10 systems to stop automatically checking for software updates.

That issue was quickly fixed, but now, **two security vulnerabilities have been found** in [sudo-rs](https://bugs.launchpad.net/ubuntu/+source/rust-sudo-rs/+bug/2130623?ref=itsfoss.com).

## Better Now than Later

The [first vulnerability](https://github.com/trifectatechfoundation/sudo-rs/security/advisories/GHSA-c978-wq47-pvvw?ref=itsfoss.com) involves **password exposure during timeouts**. When users type a password but don't press enter, the timeout causes those keystrokes to replay onto the console. This could reveal partial passwords in shell history or on screen.

The [second issue](https://github.com/trifectatechfoundation/sudo-rs/security/advisories/GHSA-q428-6v73-fc4q?ref=itsfoss.com) affects timestamp authentication. When `Defaults targetpw` or `Defaults rootpw` options are enabled, [*sudo-rs*](https://itsfoss.com/sudo-vs-sudo-rs/) **incorrectly recorded the wrong user ID in timestamps**. This allowed bypassing authentication by reusing cached credentials even when policy required a different password.

Patches for both issues have been released in [sudo-rs 0.2.10](https://github.com/trifectatechfoundation/sudo-rs/releases/tag/v0.2.10?ref=itsfoss.com). Ubuntu is set to push the fixes through a [Stable Release Update](https://documentation.ubuntu.com/project/SRU/stable-release-updates/index.html?ref=itsfoss.com) (SRU).

These bugs being caught in Ubuntu 25.10 **is actually a good sign**. The interim release serves as a testing ground before Ubuntu 26.04 LTS arrives in April 2026\. Finding critical security flaws now allows developers ample time to address them.

## Here's the Fix!

At the time of writing, [the updated sudo-rs package](https://github.com/trifectatechfoundation/sudo-rs/releases/tag/v0.2.10?ref=itsfoss.com) had not yet arrived in the Ubuntu 25.10 repositories. But it should be available soon.

Once the update is live, you can get the fix using the graphical [Software Updater](https://itsfoss.com/update-ubuntu/#method-2-update-ubuntu-via-the-gui-for-desktop-users-) tool by launching it from your application menu and installing any available security updates.

![](https://itsfoss.com/content/images/2025/11/ubuntu-25-10-sudo-rs-update-process-1.png)

![](https://itsfoss.com/content/images/2025/11/ubuntu-25-10-sudo-rs-update-process-2.png)

**sudo-rs' upgrade process on Ubuntu 25.10.*

Alternatively, you can use the terminal. Run these commands **one after the other** to get the patch:

```
sudo-rs apt update
```

```
sudo-rs apt upgrade
```

*PS: Using `sudo` instead of `sudo-rs` also works the same.*

Via: [Phoronix](https://www.phoronix.com/news/sudo-rs-security-ubuntu-25.10?ref=itsfoss.com)

**Suggested Read 📖**

[sudo vs sudo-rs: What You Need to Knowsudo-rs is poised to take over. Here’s what you should know about sudo-rs as a sudo user.![](https://itsfoss.com/content/images/icon/android-chrome-512x512-6.png)It's FOSSAbhishek Prakash![](https://itsfoss.com/content/images/thumbnail/sudo-rs-1.png)](https://itsfoss.com/sudo-vs-sudo-rs/)