CVE-2023-3758: Sssd: race condition during authorization leads to gpo policies functioning inconsistently
A race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated users. This may lead to improper authorization issues, granting or denying access to resources inappropriately.
Other sources
A race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated users. This may lead to improper authorization issues, granting access to resources inappropriately.
References:
https://bugzilla.redhat.com/showbug.cgi?id=2222429
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/sssdto a version that resolves this vulnerability.Fixed in 2.2.3-3ubuntu0.13 - Upgrade
Upgrade
ubuntu/sssdto a version that resolves this vulnerability.Fixed in 2.6.3-1ubuntu3.3 - Upgrade
Upgrade
ubuntu/sssdto a version that resolves this vulnerability.Fixed in 2.9.1-2ubuntu2.1 - Upgrade
Upgrade
ubuntu/sssdto a version that resolves this vulnerability.Fixed in 2.9.4-1.1ubuntu6.1 - Upgrade
Upgrade
ubuntu/sssdto a version that resolves this vulnerability.Fixed in 2.9.5-1 - Upgrade
Upgrade
debian/sssdto a version that resolves this vulnerability.Fixed in 2.9.5-3
Event History
Frequently Asked Questions
What is the severity of CVE-2023-3758?
CVE-2023-3758 is classified as a medium severity vulnerability due to its potential for improper authorization issues.
How do I fix CVE-2023-3758?
To fix CVE-2023-3758, upgrade the sssd package to versions 2.2.3-3ubuntu0.13, 2.6.3-1ubuntu3.3, 2.9.1-2ubuntu2.1, 2.9.4-1.1ubuntu6.1, or 2.9.5-1 depending on your distribution.
What systems are affected by CVE-2023-3758?
CVE-2023-3758 affects various versions of the sssd package on Ubuntu and Debian systems.
What kind of vulnerability is CVE-2023-3758?
CVE-2023-3758 is a race condition vulnerability that affects the application of GPO policies in sssd.
What are the potential consequences of CVE-2023-3758?
The potential consequences of CVE-2023-3758 include unauthorized resource access due to inconsistent application of GPO policies.