Update to address two moderate vulnerabilities

[Simon Johnsson]

PPA with fix: https://launchpad.net/~bamf0/+archive/ubuntu/rust-sudo-rs-lp2130623/+packages
Repository with fix: https://code.launchpad.net/~bamf0/ubuntu/+source/cve-fixes/+git/cve-fixes/+ref/sudo-rs-sru-lp2130623-questing
---
Upstream will release a fix for two moderate vulnerabilities targeting Friday (Nov 7 2025).

The expected coordinated release of this fix is Monday (Nov 10 2025).

One of these vulnerabilities is CVE-2025-64170.

Course of action:
- The change suggested by upstream is to update the package (SRU)
- There are not any changes in dependencies with respect to version 0.2.8

[Simon Johnsson (bamf0)]

We have been in contact with Marc Schoolderman <email address hidden> from upstream.

Marc Deslauriers <email address hidden> from security has been notified.

[Simon Johnsson (bamf0)]

The fixes have been released and I am preparing a security SRU.

[Simon Johnsson (bamf0)]

Here is the preliminary patch for GHSA-c978-wq47-pvvw. Awaiting build success before forwarding to security.

[Simon Johnsson (bamf0)]

Here is the preliminary patch for GHSA-q428-6v73-fc4q. Awaiting build success before forwarding to security.

[Wesley Hershberger (whershberger)]

Hey Simon, thanks for hopping on this. Security uploads have a few special requirements for changelog entries and should target `questing-security` instead of `questing` [1].

lp-2130623-GHSA-q428-6v73-fc4q.patch looks good to me.

[1] https://wiki.ubuntu.com/SecurityTeam/UpdatePreparation#Packaging

[Marc Deslauriers (mdeslaur)]

I am preparing the questing security upload in the security team PPA now.

[Launchpad Janitor (janitor)]

This bug was fixed in the package rust-sudo-rs - 0.2.8-1ubuntu5.2

---------------
rust-sudo-rs (0.2.8-1ubuntu5.2) questing-security; urgency=high

  * SECURITY UPDATE: multiple security fixes (LP: #2130623)
    - debian/patches/lp-2130623-GHSA-q428-6v73-fc4q-*.patch
    - debian/patches/lp-2130623-GHSA-c978-wq47-pvvw-*.patch
    - CVE numbers pending

 -- Simon Johnsson <email address hidden> Mon, 10 Nov 2025 16:12:00 +0100

[Marc Deslauriers (mdeslaur)]

I am making this bug public since the two commits are now in the upstream repo and listed in the changes file.

[Ubuntu Foundations Team Bug Bot (crichton)]

The attachment "lp-2130623-GHSA-c978-wq47-pvvw.patch" seems to be a patch. If it isn't, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are a member of the ~ubuntu-reviewers, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issues please contact him.]

[Marc Deslauriers (mdeslaur)]

FYI, an update for these issues was published for Ubuntu 25.10 on Monday:

https://ubuntu.com/security/notices/USN-7867-1