The fixed patch was submitted to SLE12SP2. When it's released there, it will be inherited to openSUSE:Leap:42.2. openSUSE:Factory and openSUSE:Leap:42.3 are not affected (we have sudo 1.8.20p2 here - fixed upstream in https://www.sudo.ws/repos/sudo/rev/ef737b5d4ed8)