rpm package
suse/sssd&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP4
pkg:rpm/suse/sssd&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4
Vulnerabilities (5)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2022-4254 | — | < 1.16.1-4.43.1 | 1.16.1-4.43.1 | Feb 1, 2023 | sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters | ||
| CVE-2021-3621 | — | < 1.16.1-4.40.1 | 1.16.1-4.40.1 | Dec 23, 2021 | A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cache-expire subcommands. This flaw allows an attacker to trick the root user into running a specially crafted sssctl command, such as via sudo, to gain root access | ||
| CVE-2018-16838 | — | < 1.16.1-4.12.2 | 1.16.1-4.12.2 | Mar 25, 2019 | A flaw was found in sssd Group Policy Objects implementation. When the GPO is not readable by SSSD due to a too strict permission settings on the server side, SSSD will allow all authenticated users to login instead of denying access. | ||
| CVE-2019-3811 | — | < 1.16.1-4.3.2 | 1.16.1-4.3.2 | Jan 15, 2019 | A vulnerability was found in sssd. If a user was configured with no home directory set, sssd would return '/' (the root directory) instead of '' (the empty string / no home directory). This could impact services that restrict the user's filesystem access to within their home dire | ||
| CVE-2018-10852 | Low | 3.8 | < 1.16.1-4.3.2 | 1.16.1-4.3.2 | Jun 26, 2018 | The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD has too wide permissions, which means that anyone who can send a message using the same raw protocol that sudo and SSSD use can read the sudo rules available for any user. This affects versi |
- CVE-2022-4254Feb 1, 2023affected < 1.16.1-4.43.1fixed 1.16.1-4.43.1
sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters
- CVE-2021-3621Dec 23, 2021affected < 1.16.1-4.40.1fixed 1.16.1-4.40.1
A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cache-expire subcommands. This flaw allows an attacker to trick the root user into running a specially crafted sssctl command, such as via sudo, to gain root access
- CVE-2018-16838Mar 25, 2019affected < 1.16.1-4.12.2fixed 1.16.1-4.12.2
A flaw was found in sssd Group Policy Objects implementation. When the GPO is not readable by SSSD due to a too strict permission settings on the server side, SSSD will allow all authenticated users to login instead of denying access.
- CVE-2019-3811Jan 15, 2019affected < 1.16.1-4.3.2fixed 1.16.1-4.3.2
A vulnerability was found in sssd. If a user was configured with no home directory set, sssd would return '/' (the root directory) instead of '' (the empty string / no home directory). This could impact services that restrict the user's filesystem access to within their home dire
- affected < 1.16.1-4.3.2fixed 1.16.1-4.3.2
The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD has too wide permissions, which means that anyone who can send a message using the same raw protocol that sudo and SSSD use can read the sudo rules available for any user. This affects versi