sudo time checks for sudoers NOTBEFORE/NOTAFTER rules with timestamps missing trailing Z use caller-controlled TZ. A local low-privileged user can set an extreme TZ offset to shift the authorization window by ~25 hours, making expired rules valid and allowing command execution outside the intended window (auth not bypassed). Fix by appending Z to all such timestamps.