RHSA-2026:97077: Moderate: sssd security, bug fix, and enhancement update
The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to connect to multiple different account sources.Security Fix(es): sssd: out-of-bounds read in the sssd (CVE-2026-6245) sssd: Use-after-free crash in SSSD' 'sssdpam' process (CVE-2026-12610) Bug Fix(es) and Enhancement(s): Concurrent child processes trigger unnecessarily backtrace (JIRA:RHEL-108116) Performance impact with enumerate in SSSD > 2.7.3 (JIRA:RHEL-109754) Man page update: man sssdkrb5localauthplugin ? Missing disable = an2ln (JIRA:RHEL-123943) [RFE] SSSD PAM: Support Microsoft AD PKINIT authentication indicator (ms-pkca) for pamgssapiindicatorsmap (JIRA:RHEL-138905) Poor performance of BEREQINITGROUPS handling by 'sssdbe' (LDAP RFC2307, no nested groups) (JIRA:RHEL-142964) SSSD needs to add Plasma Login Manager to the PAM services whitelist for the AD provider (JIRA:RHEL-154156) Detect foreign security principals in AD group members and silently ignore them (JIRA:RHEL-5049) [RfE] sssdoidc: IdP client using TLS Certificate for authentication (JIRA:RHEL-83540) SSSD kerberos plugins export symbols which clash (JIRA:RHEL-151491) sssdbe segfaults with option "enumerate = true" with idprovider=ldap (JIRA:RHEL-153036) SSSD: LDAP backend ('sssdbe') initialization fails if DNS in unresponsive (JIRA:RHEL-172303) SSSD 2.13 doesn't work in offline mode, generates plenty of Permission denied errors (JIRA:RHEL-173660) [Regression] Cannot log in to FreeIPA account with password immediately after boot (JIRA:RHEL-173663) 'sssctl analyze --help' shows incorrect command in usage field (JIRA:RHEL-178180) Rebase SSSD for RHEL 10.3 (JIRA:RHEL-183331) Smart card reader with pinpad fails CLogin. (CKFPROTECTEDAUTHENTICATIONPATH not handled correctly) (JIRA:RHEL-5054) 'sssctl config-check' does not work correctly for "Accessing AD with a MSA" (JIRA:RHEL-111571) Regression in IPA + Idp authentication with keycloak (JIRA:RHEL-185008) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Additional Changes:For detailed information on changes in this release, see the Red Hat Enterprise Linux 10 Release Notes linked from the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/sssdto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10 - Upgrade
Upgrade
redhat/python3-sssto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10 - Upgrade
Upgrade
redhat/python3-sss-debuginfoto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10 - Upgrade
Upgrade
redhat/python3-sss-murmurto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10 - Upgrade
Upgrade
redhat/python3-sss-murmur-debuginfoto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10 - Upgrade
Upgrade
redhat/python3-sssdconfigto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10 - Upgrade
Upgrade
redhat/sssd-adto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10 - Upgrade
Upgrade
redhat/sssd-ad-debuginfoto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10 - Upgrade
Upgrade
redhat/sssd-clientto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10 - Upgrade
Upgrade
redhat/sssd-client-debuginfoto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10 - Upgrade
Upgrade
redhat/sssd-commonto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10 - Upgrade
Upgrade
redhat/sssd-common-debuginfoto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10 - Upgrade
Upgrade
redhat/sssd-common-pacto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10 - Upgrade
Upgrade
redhat/sssd-common-pac-debuginfoto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10 - Upgrade
Upgrade
redhat/sssd-dbusto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10 - Upgrade
Upgrade
redhat/sssd-dbus-debuginfoto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10 - Upgrade
Upgrade
redhat/sssd-debuginfoto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10 - Upgrade
Upgrade
redhat/sssd-debugsourceto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10 - Upgrade
Upgrade
redhat/sssd-idpto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10 - Upgrade
Upgrade
redhat/sssd-idp-debuginfoto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10 - Upgrade
Upgrade
redhat/sssd-ipato a version that resolves this vulnerability.Fixed in 2.13.1-2.el10 - Upgrade
Upgrade
redhat/sssd-ipa-debuginfoto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10 - Upgrade
Upgrade
redhat/sssd-kcmto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10 - Upgrade
Upgrade
redhat/sssd-kcm-debuginfoto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10 - Upgrade
Upgrade
redhat/sssd-krb5to a version that resolves this vulnerability.Fixed in 2.13.1-2.el10 - Upgrade
Upgrade
redhat/sssd-krb5-commonto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10 - Upgrade
Upgrade
redhat/sssd-krb5-common-debuginfoto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10 - Upgrade
Upgrade
redhat/sssd-krb5-debuginfoto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10 - Upgrade
Upgrade
redhat/sssd-ldapto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10 - Upgrade
Upgrade
redhat/sssd-ldap-debuginfoto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10 - Upgrade
Upgrade
redhat/sssd-nfs-idmapto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10 - Upgrade
Upgrade
redhat/sssd-nfs-idmap-debuginfoto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10 - Upgrade
Upgrade
redhat/sssd-passkeyto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10 - Upgrade
Upgrade
redhat/sssd-passkey-debuginfoto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10 - Upgrade
Upgrade
redhat/sssd-proxyto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10 - Upgrade
Upgrade
redhat/sssd-proxy-debuginfoto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10 - Upgrade
Upgrade
redhat/sssd-toolsto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10 - Upgrade
Upgrade
redhat/sssd-tools-debuginfoto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10 - Upgrade
Upgrade
redhat/sssd-winbind-idmapto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10 - Upgrade
Upgrade
redhat/sssd-winbind-idmap-debuginfoto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10 - Upgrade
Upgrade
redhat/python3-sssto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10.aa - Upgrade
Upgrade
redhat/python3-sss-debuginfoto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10.aa - Upgrade
Upgrade
redhat/python3-sss-murmurto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10.aa - Upgrade
Upgrade
redhat/python3-sss-murmur-debuginfoto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10.aa - Upgrade
Upgrade
redhat/sssdto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10.aa - Upgrade
Upgrade
redhat/sssd-adto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10.aa - Upgrade
Upgrade
redhat/sssd-ad-debuginfoto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10.aa - Upgrade
Upgrade
redhat/sssd-clientto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10.aa - Upgrade
Upgrade
redhat/sssd-client-debuginfoto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10.aa - Upgrade
Upgrade
redhat/sssd-commonto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10.aa - Upgrade
Upgrade
redhat/sssd-common-debuginfoto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10.aa - Upgrade
Upgrade
redhat/sssd-common-pacto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10.aa - Upgrade
Upgrade
redhat/sssd-common-pac-debuginfoto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10.aa - Upgrade
Upgrade
redhat/sssd-dbusto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10.aa - Upgrade
Upgrade
redhat/sssd-dbus-debuginfoto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10.aa - Upgrade
Upgrade
redhat/sssd-debuginfoto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10.aa - Upgrade
Upgrade
redhat/sssd-debugsourceto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10.aa - Upgrade
Upgrade
redhat/sssd-idpto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10.aa - Upgrade
Upgrade
redhat/sssd-idp-debuginfoto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10.aa - Upgrade
Upgrade
redhat/sssd-ipato a version that resolves this vulnerability.Fixed in 2.13.1-2.el10.aa - Upgrade
Upgrade
redhat/sssd-ipa-debuginfoto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10.aa - Upgrade
Upgrade
redhat/sssd-kcmto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10.aa - Upgrade
Upgrade
redhat/sssd-kcm-debuginfoto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10.aa - Upgrade
Upgrade
redhat/sssd-krb5to a version that resolves this vulnerability.Fixed in 2.13.1-2.el10.aa - Upgrade
Upgrade
redhat/sssd-krb5-commonto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10.aa - Upgrade
Upgrade
redhat/sssd-krb5-common-debuginfoto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10.aa - Upgrade
Upgrade
redhat/sssd-krb5-debuginfoto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10.aa - Upgrade
Upgrade
redhat/sssd-ldapto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10.aa - Upgrade
Upgrade
redhat/sssd-ldap-debuginfoto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10.aa - Upgrade
Upgrade
redhat/sssd-nfs-idmapto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10.aa - Upgrade
Upgrade
redhat/sssd-nfs-idmap-debuginfoto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10.aa - Upgrade
Upgrade
redhat/sssd-passkeyto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10.aa - Upgrade
Upgrade
redhat/sssd-passkey-debuginfoto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10.aa - Upgrade
Upgrade
redhat/sssd-proxyto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10.aa - Upgrade
Upgrade
redhat/sssd-proxy-debuginfoto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10.aa - Upgrade
Upgrade
redhat/sssd-toolsto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10.aa - Upgrade
Upgrade
redhat/sssd-tools-debuginfoto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10.aa - Upgrade
Upgrade
redhat/sssd-winbind-idmapto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10.aa - Upgrade
Upgrade
redhat/sssd-winbind-idmap-debuginfoto a version that resolves this vulnerability.Fixed in 2.13.1-2.el10.aa