CVE-2018-10852: Infoleak
The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD has too wide permissions, which means that anyone who can send a message using the same raw protocol that sudo and SSSD use can read the sudo rules available for any user.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2018-10852?
CVE-2018-10852 is a vulnerability in SSSD that allows unauthorized users to read sudo rules.
How severe is CVE-2018-10852?
CVE-2018-10852 is classified as a high severity vulnerability with a base score of 7.5.
Which software versions are affected by CVE-2018-10852?
Versions of SSSD before 1.16.3 are affected by CVE-2018-10852.
How can I fix CVE-2018-10852?
To fix CVE-2018-10852, update SSSD to version 1.16.3 or later.
Where can I find more information about CVE-2018-10852?
You can find more information about CVE-2018-10852 on the following references: [1](http://www.securityfocus.com/bid/104547), [2](https://access.redhat.com/errata/RHSA-2018:3158) and [3](https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10852).