Latest fedoraproject sssd Vulnerabilities

● CVE-2022-4254

sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters

Fedoraproject Sssd>=1.15.3<2.3.1

Redhat Enterprise Linux=8.0

Redhat Enterprise Linux Desktop=7.0

Redhat Enterprise Linux For Ibm Z Systems=7.0

Redhat Enterprise Linux For Power Big Endian=7.0

Redhat Enterprise Linux For Power Little Endian=7.0

and 9 more

● CVE-2021-3621

A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cache-expire subcommands. This flaw allows an attacker to trick the root user into r...

redhat/sssd<0:1.16.5-10.el7_9.10

redhat/sssd<0:2.4.0-9.el8_4.2

redhat/sssd<0:2.2.0-19.el8_1.2

redhat/sssd<0:2.2.3-20.el8_2.1

redhat/redhat-virtualization-host<0:4.3.18-20210903.0.el7_9

redhat/redhat-virtualization-host<0:4.4.7-20210804.0.el8_4

and 15 more

● CVE-2012-3462

A flaw was found in SSSD version 1.9.0. The SSSD's access-provider logic causes the result of the HBAC rule processing to be ignored in the event that the access-provider is also handling the setup of...

Fedoraproject Sssd=1.9.0

● CVE-2018-16883

sssd versions from 1.13.0 to before 2.0.0 did not properly restrict access to the infopipe according to the "allowed_uids" configuration parameter. If sensitive information were stored in the user dir...

Fedoraproject Sssd>=1.13.0<2.0.0

● CVE-2019-3811

A vulnerability was found in sssd. If a user was configured with no home directory set, sssd would return '/' (the root directory) instead of '' (the empty string / no home directory). This could impa...

redhat/sssd<0:1.16.4-21.el7

Fedoraproject Sssd<2.1

Debian Debian Linux=8.0

Fedoraproject Fedora

openSUSE Leap=15.0

openSUSE Leap=42.3

and 1 more

● CVE-2018-16838

A flaw was found in sssd Group Policy Objects implementation. When the GPO is not readable by SSSD due to a too strict permission settings on the server side, SSSD will allow all authenticated users t...

redhat/sssd<0:1.16.4-21.el7

redhat/sssd<0:2.2.0-19.el8

redhat/imgbased<0:1.1.9-0.1.el7e

redhat/ovirt-node-ng<0:4.3.5-0.20190717.0.el7e

redhat/redhat-release-virtualization-host<0:4.3.5-2.el7e

redhat/redhat-virtualization-host<0:4.3.5-20190722.0.el7_7

and 2 more

● CVE-2018-10852

The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD has too wide permissions, which means that anyone who can send a message using the same raw protocol that sudo...

redhat/SSSD<1.16.3

Debian Debian Linux=8.0

Fedoraproject Sssd<1.16.3

Redhat Enterprise Linux Desktop=7.0

Redhat Enterprise Linux Server=7.0

Redhat Enterprise Linux Workstation=7.0

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.