SUSE CVE-2017-12173

It was found that sssd's sysdbsearchuserbyupnres function before 1.16.0 did not sanitize requests when querying its local cache and was vulnerable to injection. In a centralized login environment, if a password hash was locally cached for a given user, an authenticated attacker could use this fla...

SUSE CVE-2018-10852

The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD has too wide permissions, which means that anyone who can send a message using the same raw protocol that sudo and SSSD use can read the sudo rules available for any user. This affects versions of SSSD befor...

SUSE CVE-2019-3811

A vulnerability was found in sssd. If a user was configured with no home directory set, sssd would return '/' the root directory instead of '' the empty string / no home directory. This could impact services that restrict the user's filesystem access to within their home directory through chroot...

SUSE CVE-2022-4254

sssd: libssscertmap fails to sanitise certificate data used in LDAP filters...

SUSE SLES12: libipa_hbac-devel / libipa_hbac0 / libsss_certmap0 / etc (SUSE-SU-2023:0301-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:0301-1 advisory. - CVE-2022-4254: Fixed a bug in libssscertmap which could allow an attacker to gain control of the admin account and perform a full domain...

SUSE SLES15: libipa_hbac-devel / libipa_hbac0 / libsss_certmap-devel / etc (SUSE-SU-2023:0292-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:0292-1 advisory. - CVE-2022-4254: Fixed a bug in libssscertmap which could allow an attacker to gain control of the admin account and perform a full domain...

SUSE SLES15: libipa_hbac-devel / libipa_hbac0 / libsss_certmap-devel / etc (SUSE-SU-2023:0300-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:0300-1 advisory. - CVE-2022-4254: Fixed a bug in libssscertmap which could allow an attacker to gain control of the admin account and perform a full domain...

SUSE: Security Advisory (SUSE-SU-2023:0300-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2023:0301-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2023:0301-1 Security update for sssd

This update for sssd fixes the following issues: - CVE-2022-4254: Fixed a bug in libssscertmap which could allow an attacker to gain control of the admin account and perform a full domain takeover. bsc1207474 - Move systemd RPM macros managing the service from 'sssd-common' to 'sssd' package...

SUSE-SU-2023:0300-1 Security update for sssd

This update for sssd fixes the following issues: - CVE-2022-4254: Fixed a bug in libssscertmap which could allow an attacker to gain control of the admin account and perform a full domain takeover. bsc1207474...

SUSE-SU-2023:0292-1 Security update for sssd

This update for sssd fixes the following issues: - CVE-2022-4254: Fixed a bug in libssscertmap which could allow an attacker to gain control of the admin account and perform a full domain takeover. bsc1207474...

LDAP Injection

sssd is vulnerable to LDAP Injection. The vulnerability exists because the libssscertmap fails to sanitize certificate data used in LDAP filters...

CVE-2022-4254

sssd: libssscertmap fails to sanitise certificate data used in LDAP filters...

CVE-2022-4254

sssd: libssscertmap fails to sanitise certificate data used in LDAP filters...

CVE-2022-4254

sssd: libssscertmap fails to sanitise certificate data used in LDAP filters...

CVE-2022-4254: Improper Neutralization of Special Elements used in an LDAP Query

sssd: libssscertmap fails to sanitise certificate data used in LDAP filters...

CVE-2022-4254

CVE-2022-4254 concerns sssd’s libsss_certmap, where certificate data used in LDAP filters is not sanitized, enabling LDAP filter injection. Public disclosures and advisories (e.g., Debian DLA 3436-1/3436-2, ALAS2-2023-1995, ALAS-2023-1723) indicate the issue can lead to privilege escalation or ad...

CVE-2022-4254

sssd: libssscertmap fails to sanitise certificate data used in LDAP filters...

The vulnerability of the libsss_certmap package from the access control service for remote directories and the sssd authentication mechanism allows a perpetrator to increase their privileges.

The vulnerability of the libssscertmap package, a service for managing access to remote directories and an authentication mechanism for sssd, is related to the inability to clear certificate data when using LDAP filtering. Exploiting this vulnerability could allow a malicious actor to increase...