CVE-2022-42717: An issue was discovered in Hashicorp Packer before 2.3.1

Q: How do I fix CVE-2022-42717?

vagrant: upgrade to 2.3.1. Exact commands for each OS are on this page.

Q: Is CVE-2022-42717 being exploited?

CVE-2022-42717 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2022-42717 affect?

CVE-2022-42717 affects vagrant. Severity is high (CVSS 7.8). An issue was discovered in Hashicorp Packer before 2.3.1. The recommended sudoers configuration for Vagrant on Linux is insecure. If the host has been configured according to this documentation, non-privileged users on the host can leverage

Routine

HIGH 7.8UPGRADE

CVE-2022-42717 is a high-severity flaw (CVSS 7.8) affecting vagrant. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

An issue was discovered in Hashicorp Packer before 2.3.1. The recommended sudoers configuration for Vagrant on Linux is insecure. If the host has been configured according to this documentation, non-privileged users on the host can leverage a wildcard in the sudoers configuration to execute arbitrary commands as root.

Why this priority

High severity

A fixed release or distro patch exists.

Risk facts

CVSS score	7.8 (High)
Attack vector	Local
Attack complexity	Low
Privileges needed	Low
User interaction	None
EPSS exploit chance	0.3% (top 83%)
CISA exploited list	No
Weakness	CWE-284
Published	2022-10-11
Last modified	2026-06-17

Publisher (CNA): MITRE · Vendor: hashicorp

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2022-10-11 23:15 UTCPublished CVE record published
2026-06-17 05:05 UTCUpdated Record last modified

hashicorp vagrant UPGRADE

Affected: < 2.3.1

Fixed in: 2.3.1

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy vagrant || rpm -q vagrant || vagrant --version

2. UPGRADE to 2.3.1 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade vagrant

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade vagrant

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2022-42717?

vagrant: upgrade to 2.3.1. Exact commands for each OS are on this page.

Is CVE-2022-42717 being exploited?

CVE-2022-42717 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2022-42717 affect?

CVE-2022-42717 affects vagrant. Severity is high (CVSS 7.8). An issue was discovered in Hashicorp Packer before 2.3.1. The recommended sudoers configuration for Vagrant on Linux is insecure. If the host has been configured according to this documentation, non-privileged users on the host can leverage

How urgent is CVE-2022-42717?

Priority 32/100. High severity

Related CVEs

CVE-2023-5834 LOW 3.8 UPGRADE HashiCorp Vagrant's Windows installer targeted a custom location with a non-protected path that could be junct
CVE-2021-21361 MEDIUM 5.3 UPGRADE The `com.bmuschko:gradle-vagrant-plugin` Gradle plugin contains an information disclosure vulnerability due to
CVE-2017-16777 HIGH 7.8 DOWNGRADE If HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 5.0.3 is installed but VMware Fusion is
CVE-2017-16001 HIGH 7.8 DOWNGRADE In HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 5.0.1, a local attacker or malware can s

References

← Back to latest CVEs