It was discovered that sssd versions prior to 2.0.0 did not properly restrict access to the infopipe according to the "alloweduids" parameter. If sensitive information were stored in the user directory, this could be inadvertently disclosed to local attackers.

A memory leak was found in the sssdpacplugin (sssdpacplugin.so library), which is distributed with the sssdclient package.

Original report with additional details:

https://fedorahosted.org/sssd/ticket/2803

Patch:

https://fedorahosted.org/sssd/attachment/ticket/2803/0001-Fix-memory-leak-in-sssdpacverify.patch