CVE-2021-23239: Debian Linux

Low severity, CVSS 2.5. EPSS: 1% chance of exploitation in the next 30 days.

The sudoedit personality of Sudo before 1.9.5 may allow a local unprivileged user to perform arbitrary directory-existence tests by winning a sudo_edit.c race condition in replacing a user-controlled directory by a symlink to an arbitrary path.

Affected products

• Debian Debian Linux: version 10.0 only
• Fedoraproject Fedora: version 32 only; version 33 only
• Netapp Cloud Backup: affected versions not specified
• Netapp Hci Management Node: affected versions not specified
• Netapp Solidfire: affected versions not specified
• Sudo Project Sudo: before 1.8.32 (fixed in 1.8.32); from 1.9.0, before 1.9.5 (fixed in 1.9.5)

Published 2021-01-12. Last modified 2026-06-17.