QSN-8895-1: Sudo vulnerability
2026-10-07

Summary:
Sudo could allow a local user to bypass time-based access
restrictions.

Details:
It was discovered that Sudo did not properly handle time-based access
restrictions when sudoers rules used NOTBEFORE or NOTAFTER with
timestamps omitting the trailing timezone indicator. A local attacker
could possibly use this issue to execute commands outside the intended
time window by manipulating the TZ environment variable.

Affected QuantaStor releases:
  6.9.1.001 jammy: sudo 1.9.9-1ubuntu2.4 (fixed in 1.9.9-1ubuntu2.7)
  6.9.0.464 jammy: sudo 1.9.9-1ubuntu2.4 (fixed in 1.9.9-1ubuntu2.7)
  6.8.6.015 jammy: sudo 1.9.9-1ubuntu2.4 (fixed in 1.9.9-1ubuntu2.7)
  6.8.5.018 jammy: sudo 1.9.9-1ubuntu2.4 (fixed in 1.9.9-1ubuntu2.7)
  6.8.4.038 jammy: sudo 1.9.9-1ubuntu2.4 (fixed in 1.9.9-1ubuntu2.7)
  6.8.3.018 jammy: sudo 1.9.9-1ubuntu2.4 (fixed in 1.9.9-1ubuntu2.7)
  6.8.2.002 jammy: sudo 1.9.9-1ubuntu2.4 (fixed in 1.9.9-1ubuntu2.7)
  6.8.1.007 jammy: sudo 1.9.9-1ubuntu2.4 (fixed in 1.9.9-1ubuntu2.7)
  6.8.0.205 jammy: sudo 1.9.9-1ubuntu2.4 (fixed in 1.9.9-1ubuntu2.7)

CVEs: CVE-2026-96512

References:
  https://ubuntu.com/security/notices/USN-8895-1