sudo 1.9.17p1 released

Sudo version 1.9.17p1 is now available.  This fixes two serious
security issues in sudo.  For full information, see
https://www.sudo.ws/security/advisories/host_any/ and
https://www.sudo.ws/security/advisories/chroot_bug/.

Source:
    https://www.sudo.ws/dist/sudo-1.9.17p1.tar.gz
    ftp://ftp.sudo.ws/pub/sudo/sudo-1.9.17p1.tar.gz

SHA256 checksum:
    ff607ea717072197738a78f778692cd6df9a7e3e404565f51de063ca27455d32
MD5 checksum:
    231106344ffe541fa8e0bd4caf322497

Binary packages:
    https://www.sudo.ws/getting/packages/
    https://github.com/sudo-project/sudo/releases/tag/v1.9.17p1

For a list of download mirror sites, see:
    https://www.sudo.ws/getting/download_mirrors/

Sudo web site:
    https://www.sudo.ws/

Major changes between sudo 1.9.17p1 and 1.9.17

 * Fixed CVE-2025-32462.  Sudo's -h (--host) option could be specified
   when running a command or editing a file.  This could enable a
   local privilege escalation attack if the sudoers file allows the
   user to run commands on a different host.  See
   https://www.sudo.ws/security/advisories/host_any/.

 * Fixed CVE-2025-32463.  An attacker can leverage sudo's -R
   (--chroot) option to run arbitrary commands as root, even if
   they are not listed in the sudoers file.  The chroot support has
   been deprecated an will be removed entirely in a future release.
   See https://www.sudo.ws/security/advisories/chroot_bug/.
____________________________________________________________
sudo-announce mailing list <[email protected]>
For list information, options, or to unsubscribe, visit:
https://www.sudo.ws/mailman/listinfo/sudo-announce