sssd: fallback_homedir returns '/' for empty home directories in passwd file

A vulnerability was found in sssd where, if a user was configured with no home directory set, sssd would return '/' the root directory instead of '' the empty string / no home directory. This could impact services that restrict the user's filesystem access to within their home directory through...

EulerOS 2.0 SP2 : sssd (EulerOS-SA-2019-1754)

According to the version of the sssd packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A vulnerability was found in sssd where, if a user was configured with no home directory set, sssd would return '/' the root directory instead of ''...

EulerOS Virtualization for ARM 64 3.0.2.0 : sssd (EulerOS-SA-2019-1701)

According to the version of the sssd packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - A vulnerability was found in sssd where, if a user was configured with no home directory set, sssd would return '/' the roo...

EulerOS 2.0 SP8 : sssd (EulerOS-SA-2019-1660)

According to the version of the sssd packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A vulnerability was found in sssd where, if a user was configured with no home directory set, sssd would return '/' the root directory instead of ''...

EulerOS 2.0 SP5 : sssd (EulerOS-SA-2019-1669)

According to the version of the sssd packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A vulnerability was found in sssd where, if a user was configured with no home directory set, sssd would return '/' the root directory instead of ''...

openSUSE Security Update : sssd (openSUSE-2019-1589)

This update for sssd fixes the following issues : Security issue fixed : - CVE-2018-16838: Fixed an authentication bypass related to the Group Policy Objects implementation bsc1124194. Non-security issues fixed : - Allow defaults sudoRole without sudoUser attribute bsc1135247 - Missing GPOs...

openSUSE: Security Advisory for sssd (openSUSE-SU-2019:1589-1)

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

OPENSUSE-SU-2019:1589-1 Security update for sssd

This update for sssd fixes the following issues: Security issue fixed: - CVE-2018-16838: Fixed an authentication bypass related to the Group Policy Objects implementation bsc1124194. Non-security issues fixed: - Allow defaults sudoRole without sudoUser attribute bsc1135247 - Missing GPOs director...

openSUSE Security Update : sssd (openSUSE-2019-1576)

This update for sssd fixes the following issues : Security issue fixed : - CVE-2018-16838: Fixed an authentication bypass related to the Group Policy Objects implementation bsc1124194. Non-security issue fixed : - Create directory to download and cache GPOs bsc1132879 This update was imported fro...

Security update for sssd (moderate)

openSUSE Security Update: Security update for sssd Announcement ID: openSUSE-SU-2019:1589-1 Rating: moderate References: 1124194 1132657 1132879 1135247 Cross-References: CVE-2018-16838 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 An update that solves one vulnerability and has three...

openSUSE: Security Advisory for sssd (openSUSE-SU-2019:1576-1)

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Security update for sssd (moderate)

openSUSE Security Update: Security update for sssd Announcement ID: openSUSE-SU-2019:1576-1 Rating: moderate References: 1124194 1132879 Cross-References: CVE-2018-16838 Affected Products: openSUSE Leap 42.3 An update that solves one vulnerability and has one errata is now available. Description:...

SUSE SLED12 / SLES12 Security Update : sssd (SUSE-SU-2019:1480-1)

This update for sssd fixes the following issues : Security issue fixed : CVE-2018-16838: Fixed an authentication bypass related to the Group Policy Objects implementation bsc1124194 Non-security issues fixed: Missing GPOs directory could have led to login problems bsc1132879 Fix a crash by adding...

SUSE SLED12 / SLES12 Security Update : sssd (SUSE-SU-2019:1477-1)

This update for sssd fixes the following issues : Security issue fixed : CVE-2018-16838: Fixed an authentication bypass related to the Group Policy Objects implementation bsc1124194. Non-security issue fixed: Create directory to download and cache GPOs bsc1132879 Note that Tenable Network Securit...

SUSE SLED15 / SLES15 Security Update : sssd (SUSE-SU-2019:1476-1)

This update for sssd fixes the following issues : Security issue fixed : CVE-2018-16838: Fixed an authentication bypass related to the Group Policy Objects implementation bsc1124194. Non-security issues fixed: Allow defaults sudoRole without sudoUser attribute bsc1135247 Missing GPOs directory...

SUSE-SU-2019:1477-1 Security update for sssd

This update for sssd fixes the following issues: Security issue fixed: - CVE-2018-16838: Fixed an authentication bypass related to the Group Policy Objects implementation bsc1124194. Non-security issue fixed: - Create directory to download and cache GPOs bsc1132879...

EulerOS Virtualization for ARM 64 3.0.1.0 : sssd (EulerOS-SA-2019-1411)

According to the versions of the sssd packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD utilizes too broad of a set of...

MGASA-2019-0152 Updated ldb packages fix security vulnerability

Garming Sam reported an out-of-bounds read in the ldbwildcardcompare function of ldb, resulting in denial of service CVE-2019-3824. The ldb package has been updated to version 1.2.4 to fix this issue. The sssd and samba packages have been rebuilt against the updated ldb. If a user was configured...

Updated ldb packages fix security vulnerability

Garming Sam reported an out-of-bounds read in the ldbwildcardcompare function of ldb, resulting in denial of service CVE-2019-3824. The ldb package has been updated to version 1.2.4 to fix this issue. The sssd and samba packages have been rebuilt against the updated ldb. If a user was configured...

Improper Input Validation

The sudo superuser do utility allows system administrators to give certain users the ability to run commands as root. A flaw was found in the way sudo handled time stamp files. An attacker able to run code as a local user and with the ability to control the system clock could possibly gain...