CVE-2025-32463: A caller-owned chroot changes root's name-service lookup

A sudo invocation reads name-service configuration from a caller-owned directory before authorization finishes. Contain the exposed path and restore the affected workflow without weakening its security boundary.

Jamie Engineering lead · 02:13 a.m.

Event tickets / sa-east. Investigate host, restore service, and verify the result.