SUSE SLED12 / SLES12 Security Update : sssd (SUSE-SU-2019:0081-1)

This update for sssd provides the following fixes : This security issue was fixed : CVE-2018-10852: Set stricter permissions on /var/lib/sss/pipes/sudo to prevent the disclosure of sudo rules for arbitrary users bsc1098377 The update package also includes non-security fixes. See advisory for...

Security update for sssd (moderate)

openSUSE Security Update: Security update for sssd Announcement ID: openSUSE-SU-2019:0051-1 Rating: moderate References: 1010700 1072728 1080156 1087320 1098377 1101877 1110299 Cross-References: CVE-2018-10852 Affected Products: openSUSE Leap 42.3 An update that solves one vulnerability and has 6...

CVE-2019-3811

A vulnerability was found in sssd where, if a user was configured with no home directory set, sssd would return '/' the root directory instead of '' the empty string / no home directory. This could impact services that restrict the user's filesystem access to within their home directory through...

SUSE-SU-2019:0081-1 Security update for sssd

This update for sssd provides the following fixes: This security issue was fixed: - CVE-2018-10852: Set stricter permissions on /var/lib/sss/pipes/sudo to prevent the disclosure of sudo rules for arbitrary users bsc1098377 These non-security issues were fixed: - Fix a segmentation fault in ssscac...

SUSE SLED15 / SLES15 Security Update : sssd (SUSE-SU-2018:2144-1)

This update for sssd fixes the following security issue : - CVE-2018-10852: Set stricter permissions on /var/lib/sss/pipes/sudo to prevent the disclosure of sudo rules for arbitrary users bsc1098377. Note that Tenable Network Security has extracted the preceding description block directly from th...

EulerOS 2.0 SP2 : sssd (EulerOS-SA-2018-1429)

According to the version of the sssd packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - sssd: information leak from the sssd-sudo responder.CVE-2018-10852 Note that Tenable Network Security has extracted the preceding description block...

Amazon Linux 2 : sssd (ALAS-2018-1127)

The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD utilizes too broad of a set of permissions. Any user who can send a message using the same raw protocol that sudo and SSSD use can read the sudo rules available for any user.CVE-2018-10852 C Tenable Network...

CVE-2018-16883

sssd versions from 1.13.0 to before 2.0.0 did not properly restrict access to the infopipe according to the "alloweduids" configuration parameter. If sensitive information were stored in the user directory, this could be inadvertently disclosed to local attackers...

CVE-2018-16883

sssd versions from 1.13.0 to before 2.0.0 did not properly restrict access to the infopipe according to the "alloweduids" configuration parameter. If sensitive information were stored in the user directory, this could be inadvertently disclosed to local attackers...

CVE-2018-16883

sssd versions from 1.13.0 to before 2.0.0 did not properly restrict access to the infopipe according to the "alloweduids" configuration parameter. If sensitive information were stored in the user directory, this could be inadvertently disclosed to local attackers...

Design/Logic Flaw

sssd versions from 1.13.0 to before 2.0.0 did not properly restrict access to the infopipe according to the "alloweduids" configuration parameter. If sensitive information were stored in the user directory, this could be inadvertently disclosed to local attackers...

CVE-2018-16883

sssd versions from 1.13.0 to before 2.0.0 did not properly restrict access to the infopipe according to the "alloweduids" configuration parameter. If sensitive information were stored in the user directory, this could be inadvertently disclosed to local attackers...

CVE-2018-16883

CVE-2018-16883 affects sssd versions 1.13.0 to before 2.0.0. The vulnerability stems from improper restriction of access to the infopipe per the allowed_uids config, potentially exposing sensitive information in the user directory to local attackers. Impact is local, with partial confidentiality ...

CVE-2018-16883

sssd versions from 1.13.0 to before 2.0.0 did not properly restrict access to the infopipe according to the "alloweduids" configuration parameter. If sensitive information were stored in the user directory, this could be inadvertently disclosed to local attackers...

CVE-2018-16883

sssd, versions 1.13.0 to before 2.0.0, did not properly restrict access to the infopipe according to the "alloweduids" configuration parameter. Sensitive information could be inadvertently disclosed to local attackers if it was stored in the user directory. Mitigation This vulnerability is only...

Low: sssd

Issue Overview: The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD utilizes too broad of a set of permissions. Any user who can send a message using the same raw protocol that sudo and SSSD use can read the sudo rules available for any user.CVE-2018-10852...

EulerOS 2.0 SP3 : sssd (EulerOS-SA-2018-1403)

According to the version of the sssd packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - sssd: information leak from the sssd-sudo responder.CVE-2018-10852 Note that Tenable Network Security has extracted the preceding description block...

Scientific Linux Security Update : sssd on SL7.x x86_64 (20181030)

Security Fixes : - sssd: information leak from the sssd-sudo responder CVE-2018-10852 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid119200; scriptversion"1.5"; scriptsetattributeattribute:"pluginmodificationdate",...

CentOS 7 : sssd (CESA-2018:3158)

An update for sssd is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE li...

libipa_hbac, libsss_autofs, libsss_certmap, libsss_idmap, libsss_nss_idmap, libsss_simpleifp, libsss_sudo, python, sssd security update

CentOS Errata and Security Advisory CESA-2018:3158 An update for sssd is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, ...