[sudo-users] security bug -- sudo undefines functions in environment

[Tim Bradshaw]

On 6 Aug 2014, at 13:22, Todd C. Miller <Todd.Miller at courtesan.com> wrote:

> 
> to match the function named foo with any contents.  If no '=' is
> found in the env_keep/env_delete string only the name would be
> matched which preserves the old behavior.

Although its pathological (and I suspect may not be compliant with whatever) at least some platforms allow '=' in environment variable names.  I am not sure if this matters.