CVE-2023-3758: Sssd: race condition during authorization leads to gpo policies functioning inconsistently
Published Jul 18, 2023
·Updated
A race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated users. This may lead to improper authorization issues, granting or denying access to resources inappropriately.
Other sources
A race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated users. This may lead to improper authorization issues, granting access to resources inappropriately.
References:
https://bugzilla.redhat.com/showbug.cgi?id=2222429
— Red Hat
Affected Software
85 affected componentsFixes available
ubuntu/sssd<2.2.3-3ubuntu0.13
2.2.3-3ubuntu0.13
ubuntu/sssd<2.6.3-1ubuntu3.3
2.6.3-1ubuntu3.3
ubuntu/sssd<2.9.1-2ubuntu2.1
2.9.1-2ubuntu2.1
ubuntu/sssd<2.9.4-1.1ubuntu6.1
2.9.4-1.1ubuntu6.1
ubuntu/sssd<2.9.5-1
2.9.5-1
debian/sssd<=2.4.1-2, <=2.8.2-4
2.9.5-3
Fedoraproject Sssd<2.9.5
redhat Codeready Linux Builder=8.0
redhat Codeready Linux Builder Eus=8.6
redhat Codeready Linux Builder Eus=8.8
redhat Codeready Linux Builder Eus=9.0
redhat Codeready Linux Builder Eus=9.2
redhat Codeready Linux Builder Eus=9.4
redhat Codeready Linux Builder Eus=9.6
redhat Codeready Linux Builder For Arm64=8.0_aarch64
redhat Codeready Linux Builder For Arm64 Eus=8.6_aarch64
redhat Codeready Linux Builder For Arm64 Eus=8.8_aarch64
redhat Codeready Linux Builder For Arm64 Eus=9.0_aarch64
redhat Codeready Linux Builder For Arm64 Eus=9.2_aarch64
redhat Codeready Linux Builder For Arm64 Eus=9.4_aarch64
redhat Codeready Linux Builder For Arm64 Eus=9.6_aarch64
redhat Codeready Linux Builder For Ibm Z Systems=8.0_s390x
redhat Codeready Linux Builder For Ibm Z Systems Eus=8.6_s390x
redhat Codeready Linux Builder For Ibm Z Systems Eus=8.8_s390x
redhat Codeready Linux Builder For Ibm Z Systems Eus=9.0_s390x
redhat Codeready Linux Builder For Ibm Z Systems Eus=9.2_s390x
redhat Codeready Linux Builder For Ibm Z Systems Eus=9.4_s390x
redhat Codeready Linux Builder For Ibm Z Systems Eus=9.6_s390x
redhat Codeready Linux Builder For Power Little Endian=8.0_ppc64le
redhat Codeready Linux Builder For Power Little Endian Eus=8.6_ppc64le
redhat Codeready Linux Builder For Power Little Endian Eus=8.8_ppc64le
redhat Codeready Linux Builder For Power Little Endian Eus=9.0_ppc64le
redhat Codeready Linux Builder For Power Little Endian Eus=9.2_ppc64le
redhat Codeready Linux Builder For Power Little Endian Eus=9.4_ppc64le
redhat Codeready Linux Builder For Power Little Endian Eus=9.6_ppc64le
redhat Virtualization Host=4.0
redhat Enterprise Linux=8.0
redhat Enterprise Linux Eus=8.6
redhat Enterprise Linux Eus=8.8
redhat Enterprise Linux Eus=9.0
redhat Enterprise Linux Eus=9.2
redhat Enterprise Linux Eus=9.4
redhat Enterprise Linux Eus=9.6
redhat Enterprise Linux For Arm 64=8.0_aarch64
redhat Enterprise Linux For Arm 64 Eus=8.6_aarch64
redhat Enterprise Linux For Arm 64 Eus=8.8_aarch64
redhat Enterprise Linux For Arm 64 Eus=9.0_aarch64
redhat Enterprise Linux For Arm 64 Eus=9.2_aarch64
redhat Enterprise Linux For Arm 64 Eus=9.4_aarch64
redhat Enterprise Linux For Arm 64 Eus=9.6_aarch64
redhat Enterprise Linux For Ibm Z Systems=8.0_s390x
redhat Enterprise Linux For Ibm Z Systems Eus=8.6_s390x
redhat Enterprise Linux For Ibm Z Systems Eus=8.8_s390x
redhat Enterprise Linux For Ibm Z Systems Eus=9.0_s390x
redhat Enterprise Linux For Ibm Z Systems Eus=9.2_s390x
redhat Enterprise Linux For Ibm Z Systems Eus=9.4_s390x
redhat Enterprise Linux For Ibm Z Systems Eus=9.6_s390x
redhat Enterprise Linux For Power Little Endian=8.0_ppc64le
redhat Enterprise Linux For Power Little Endian Eus=8.6_ppc64le
redhat Enterprise Linux For Power Little Endian Eus=8.8_ppc64le
redhat Enterprise Linux For Power Little Endian Eus=9.0_ppc64le
redhat Enterprise Linux For Power Little Endian Eus=9.2_ppc64le
redhat Enterprise Linux For Power Little Endian Eus=9.4_ppc64le
redhat Enterprise Linux For Power Little Endian Eus=9.6_ppc64le
redhat Enterprise Linux Server Aus=8.6
redhat Enterprise Linux Server Aus=9.2
redhat Enterprise Linux Server Aus=9.4
redhat Enterprise Linux Server Aus=9.6
redhat Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions=8.6_ppc64le
redhat Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions=8.8_ppc64le
redhat Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions=9.0_ppc64le
redhat Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions=9.2_ppc64le
redhat Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions=9.4_ppc64le
redhat Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions=9.6_ppc64le
redhat Enterprise Linux Server Tus=8.6
redhat Enterprise Linux Server Tus=8.8
redhat Enterprise Linux Update Services For Sap Solutions=8.6
redhat Enterprise Linux Update Services For Sap Solutions=8.8
redhat Enterprise Linux Update Services For Sap Solutions=9.0
redhat Enterprise Linux Update Services For Sap Solutions=9.2
redhat Enterprise Linux Update Services For Sap Solutions=9.4
redhat Enterprise Linux Update Services For Sap Solutions=9.6
Fedoraproject Fedora=38
Fedoraproject Fedora=39
Fedoraproject Fedora=40
Remediation
Patch Available
Event History
Jul 18, 2023
Data Sourced
via Red Hat·07:35 PM
DescriptionSeverityAffected Software
Apr 18, 2024
CVE Published
via Ubuntu·12:00 AM
CVE Published
via MITRE·07:06 PM
Data Sourced
via MITRE·07:06 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·07:15 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·07:15 PM
RemedyAffected Software
Jun 19, 2024
Data Sourced
via Launchpad·12:12 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2023-3758?
CVE-2023-3758 is classified as a medium severity vulnerability due to its potential for improper authorization issues.
2
How do I fix CVE-2023-3758?
To fix CVE-2023-3758, upgrade the sssd package to versions 2.2.3-3ubuntu0.13, 2.6.3-1ubuntu3.3, 2.9.1-2ubuntu2.1, 2.9.4-1.1ubuntu6.1, or 2.9.5-1 depending on your distribution.
3
What systems are affected by CVE-2023-3758?
CVE-2023-3758 affects various versions of the sssd package on Ubuntu and Debian systems.
4
What kind of vulnerability is CVE-2023-3758?
CVE-2023-3758 is a race condition vulnerability that affects the application of GPO policies in sssd.
5
What are the potential consequences of CVE-2023-3758?
The potential consequences of CVE-2023-3758 include unauthorized resource access due to inconsistent application of GPO policies.