kcmdump

KCM dumper 用于转储 SSSD 使用的 KCM 数据库并以 CCACHE 格式恢复 Kerberos 票据的快速脚本。 最初基于 SSSDKCMExtractor 和 KCMTicketFormatter。 描述 自 版本 2.0.0 （2018-08-13）起，SSSD 的 KCM 响应器的后端存储不再加密数据库内容。然而，它仍然依赖 LDB 数据库（其本身基于 TDB），这使得可以通过类似 LDAP 的查询轻松搜索。 SSSD 使用一种自定义的存储格式来保存 Kerberos 票据，可使用此脚本将其转换为标准的 CCACHE 文件。 用法 $ apt install...

Rocky Linux 8 [CIQ] Security Update: libipa_hbac / libipa_hbac-debuginfo / libsss_autofs / etc (crlsa-2025_19610)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202519610 advisory. sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux systems CVE-2025-11561 Tenable has extracted the preceding description blo...

Rocky Linux 9.6 [CIQ] Security Update: libipa_hbac / libsss_autofs / libsss_certmap / libsss_idmap / etc (ciqsa-2026_1328)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261328 advisory. This advisory aggregates security fixes for the sssd SRPM in CIQ LTS 9.6. It addresses 1 CVE: CVE-2025-11561. Tenable has extracted the preceding description bloc...

AlmaLinux 9.6 [TuxCare] Security Update: libipa_hbac / libipa_hbac-devel / libsss_autofs / libsss_certmap / etc (ALMALINUX9.6:CLSA-2026:1787733592)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1787733592 advisory. - A flaw was found in SSSD. The sssnssprotocolparseaddr function in the NSS responder does not validate the addrlen field against the remaini...

Rocky Linux 9.6 [TuxCare] Security Update: libipa_hbac / libipa_hbac-devel / libsss_autofs / libsss_certmap / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1785345275)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1785345275 advisory. - A flaw was found in SSSD's LDAP sudo provider. When the ldapsudosearchbase option is not explicitly configured, SSSD searches th...

Rocky Linux 8 [CIQ] Security Update: libipa_hbac / libipa_hbac-debuginfo / libsss_autofs / etc (crlsa-2024_3270)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20243270 advisory. sssd: Race condition during authorization leads to GPO policies functioning inconsistently CVE-2023-3758 Tenable has extracted the preceding description block...

AlmaLinux 9.2 [TuxCare] Security Update: libipa_hbac / libipa_hbac-devel / libsss_autofs / libsss_certmap / etc (ALMALINUX9.2:CLSA-2026:1788440142)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1788440142 advisory. - A flaw was found in SSSD. The extractauthtokv1 function in the PAM responder does not validate the authtokenlength field against the...

Rocky Linux 9.6 [TuxCare] Security Update: libipa_hbac / libipa_hbac-devel / libsss_autofs / libsss_certmap / etc (ALMALINUX9.6:CLSA-2026:1787314091)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1787314091 advisory. - A flaw was found in SSSD. The extractauthtokv1 function in the PAM responder does not validate the authtokenlength field against the...

AlmaLinux 9.2 [TuxCare] Security Update: libipa_hbac / libipa_hbac-devel / libsss_autofs / libsss_certmap / etc (ALMALINUX9.2:CLSA-2025:1751143797)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1751143797 advisory. - A race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated users. This may lead to improper...

Rocky Linux 9.2 [CIQ] Security Update: libipa_hbac / libipa_hbac-debuginfo / libsss_autofs / etc (ciqsa-2026_0443)

The Rocky Linux 9.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20260443 advisory. This advisory aggregates security fixes for the sssd SRPM in CIQ LTS 9.2. It addresses 1 CVE: CVE-2023-3758. Tenable has extracted the preceding description block...

Rocky Linux 9 [CIQ] Security Update: libipa_hbac / libipa_hbac-debuginfo / libsss_autofs / etc Multiple Vulnerabilities (crlsa-2026_42122)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202642122 advisory. sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation CVE-2026-14474 sssd: sssd: GP...

Rocky Linux 8 [CIQ] Security Update: libipa_hbac / libipa_hbac-debuginfo / libsss_autofs / etc Multiple Vulnerabilities (crlsa-2026_46990)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202646990 advisory. sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation CVE-2026-14474 sssd: sssd: GP...

AlmaLinux 9.6 [TuxCare] Security Update: libipa_hbac / libipa_hbac-devel / libsss_autofs / libsss_certmap / etc (ALMALINUX9.6:CLSA-2026:1787314091)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1787314091 advisory. - A flaw was found in SSSD. The extractauthtokv1 function in the PAM responder does not validate the authtokenlength field against the...

Rocky Linux 9.6 [TuxCare] Security Update: libipa_hbac / libipa_hbac-devel / libsss_autofs / libsss_certmap / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1787127601)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1787127601 advisory. - A flaw was found in sssd. When authenticating with a YubiKey, the SSSD PAM responder can crash due to a use-after-free...

Rocky Linux 10.1 [CIQ] Security Update: libipa_hbac / libipa_hbac-debuginfo / libsss_autofs / etc (crlsa-2025_21020)

The Rocky Linux 10.1 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202521020 advisory. sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux systems CVE-2025-11561 Tenable has extracted the preceding description...

Rocky Linux 8.6 [CIQ] Security Update: libipa_hbac / libipa_hbac-debuginfo / libsss_autofs / etc (ciqsa-2026_0076)

The Rocky Linux 8.6 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20260076 advisory. This advisory aggregates security fixes for the sssd SRPM in CIQ LTS 8.6. It addresses 1 CVE: CVE-2023-3758. Tenable has extracted the preceding description block...

CentOS Linux 7 [TuxCare] Security Update: libipa_hbac / libipa_hbac-devel / libsss_autofs / libsss_certmap / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1785845028)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1785845028 advisory. - A flaw was found in SSSD's LDAP sudo provider. When the ldapsudosearchbase option is not explicitly configured, SSSD searches the enti...

Rocky Linux 8.8 [CIQ] Security Update: libipa_hbac / libipa_hbac-debuginfo / libsss_autofs / etc (ciqsa-2026_0984)

The Rocky Linux 8.8 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20260984 advisory. This advisory aggregates security fixes for the sssd SRPM in CIQ LTS 8.8. It addresses 1 CVE: CVE-2023-3758. Tenable has extracted the preceding description block...

Rocky Linux 9 [CIQ] Security Update: libipa_hbac / libipa_hbac-debuginfo / libsss_autofs / etc (crlsa-2024_2571)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20242571 advisory. sssd: Race condition during authorization leads to GPO policies functioning inconsistently CVE-2023-3758 Bug Fixes: socket leak JIRA:Rocky Linux-22340 Passkey canno...

CentOS Linux 7 [TuxCare] Security Update: libipa_hbac / libipa_hbac-devel / libsss_autofs / libsss_certmap / etc (CENTOS7:CLSA-2026:1787394686)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1787394686 advisory. - A flaw was found in SSSD. The extractauthtokv1 function in the PAM responder does not validate the authtokenlength field against the remaining...