CVE-2022-4254: High severity fedora hosted sssd vulnerability
FreeIPA supports the Kerberos PKINIT protocol extension (RFC 4556). PKINIT enables a client to authenticate to the KDC using an X.509 certificate and the corresonding private key, rather than a passphrase or keytab. FreeIPA uses mapping rules to map a certificate presented during a PKINIT authentication request to the corresponding principal. The mapping filter is vulnerable to LDAP filter injection. The search result can be influenced by values in the certificate, which may be attacker controlled. In the most extreme case, an attacker could gain control of the admin account, leading to full domain takeover.
FreeIPA is not vulnerable in its default configuration.
The problem is in libssscertmap, which is part of SSSD. FreeIPA servers use this library in ipakdb Kerberos plugin implementation.
The issue was introduced in SSSD 1.15.3 (when libssscertmap was introduced) and resolved in SSSD 2.3.1.
Other sources
sssd: libssscertmap fails to sanitise certificate data used in LDAP filters
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2022-4254.
What is the severity of CVE-2022-4254?
The severity of CVE-2022-4254 is high with a CVSS score of 8.8.
Which software is affected by CVE-2022-4254?
The software affected by CVE-2022-4254 includes SSSD and Redhat Enterprise Linux (versions 7.0, 8.0, and 8.2).
How can I fix CVE-2022-4254?
To fix CVE-2022-4254, users should update their SSSD software to version 2.3.1.
Where can I find more information about CVE-2022-4254?
More information about CVE-2022-4254 can be found at the following references: [link1], [link2], [link3].