UBUNTU-CVE-2026-68743

A flaw was found in SSSD. The extractauthtokv1 function in the PAM responder does not validate the authtokenlength field against the remaining buffer size before processing. A local attacker can exploit this via a crafted protocol v1 request to the PAM responder socket, causing an out-of-bounds...

CVE-2026-68743

SSSD's extract_authtok_v1() in the PAM responder skips validation of auth_token_length against the buffer, allowing a local attacker to trigger an out-of-bounds read and crash via a crafted protocol v1 request. Nessus flags unpatched distros; no in-the-wild exploitation is reported. Apply vendor ...

sssd: sssd: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypass

A path traversal flaw was found in SSSD's AD GPO provider. The adgpoextractsmbcomponents function does not sanitize .. sequences in the gPCFileSysPath LDAP attribute, allowing an attacker with AD GPO management access to write files outside the GPO cache directory as root. On default RHEL...

sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation

A flaw was found in SSSD's LDAP sudo provider. When the ldapsudosearchbase option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo...

Security update for bind

This update for bind fixes the following issues CVE-2026-11622: Potential memory usage beyond configured limits bsc1271986. CVE-2026-11721: Cache poisoning possible with label count discrepancy, RRSIG, and wildcards bsc1271987. CVE-2026-13204: Unexpected exit in certain situations with NSEC and...

RHSA-2026:49840 Red Hat Security Advisory: sssd security update

Bulletin has no description...

RHSA-2026:49839 Red Hat Security Advisory: sssd security update

Bulletin has no description...

CVE-2026-68744

A flaw was found in SSSD. The sssnssprotocolfillinitgr function in the NSS responder pre-allocates reply space for all group entries but does not shrink the packet when groups are skipped, causing uninitialized heap bytes to be transmitted to the client. A local attacker can exploit this to...

CVE-2026-68744

CVE-2026-68744 concerns the SSSD NSS responder. The function sss_nss_protocol_fill_initgr() pre-allocates reply space for all groups but does not shrink the packet when groups are skipped, causing uninitialized heap bytes to be sent to the client. This enables a local attacker to disclose cached ...

CVE-2026-68744 Sssd: sssd: nss responder uninitialized heap disclosure in initgroups reply

A flaw was found in SSSD. The sssnssprotocolfillinitgr function in the NSS responder pre-allocates reply space for all group entries but does not shrink the packet when groups are skipped, causing uninitialized heap bytes to be transmitted to the client. A local attacker can exploit this to...

sssd: sssd: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypass

A path traversal flaw was found in SSSD's AD GPO provider. The adgpoextractsmbcomponents function does not sanitize .. sequences in the gPCFileSysPath LDAP attribute, allowing an attacker with AD GPO management access to write files outside the GPO cache directory as root. On default RHEL...

sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation

A flaw was found in SSSD's LDAP sudo provider. When the ldapsudosearchbase option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo...

Important: Red Hat Security Advisory: sssd security update

An update for sssd is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation

A flaw was found in SSSD's LDAP sudo provider. When the ldapsudosearchbase option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo...

Important: Red Hat Security Advisory: sssd security update

An update for sssd is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Important: Red Hat Security Advisory: sssd security update

An update for sssd is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System...

sssd: sssd: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypass

A path traversal flaw was found in SSSD's AD GPO provider. The adgpoextractsmbcomponents function does not sanitize .. sequences in the gPCFileSysPath LDAP attribute, allowing an attacker with AD GPO management access to write files outside the GPO cache directory as root. On default RHEL...

PT-2026-67643

Name of the Vulnerable Software and Affected Versions SSSD affected versions not specified Description A flaw exists in the NSS responder where the sss nss protocol fill initgr function pre-allocates reply space for all group entries but fails to shrink the packet when groups are skipped. This...

RHEL 9 : sssd (RHSA-2026:49843)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:49843 advisory. The System Security Services Daemon SSSD service provides a set of daemons to manage access to remote directories and authentication...

RHEL 7 : sssd (RHSA-2026:50109)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:50109 advisory. The System Security Services Daemon SSSD service provides a set of daemons to manage access to remote directories and authentication...