A path traversal flaw was found in SSSD's AD GPO provider. The ad_gpo_extract_smb_components() function does not sanitize .. sequences in the gPCFileSysPath LDAP attribute, allowing an attacker with AD GPO management access to write files outside the GPO cache directory as root. On default RHEL configurations with SELinux enforcing, this can be used to inject Kerberos configuration leading to authentication bypass.
CVSS Details
- CVSS 3.1 Base Score: 8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python3-sssdconfigUpgrade sssd-polkit-rulesUpgrade sssd-kcmUpgrade libsss_idmapUpgrade sssd-adUpgrade python3-libsss_nss_idmapUpgrade sssd-nfs-idmapUpgrade sssdUpgrade sssd-krb5-commonUpgrade libipa_hbacUpgrade python3-sssUpgrade sssd-proxyUpgrade sssd-ipaUpgrade libsss_sudoUpgrade sssd-ldapUpgrade sssd-winbind-idmapUpgrade libsss_nss_idmap-develUpgrade libsss_simpleifpUpgrade sssd-common-pacUpgrade python3-sss-murmurUpgrade sssd-krb5Upgrade sssd-dbusUpgrade libsss_certmapUpgrade sssd-commonUpgrade libsss_nss_idmapUpgrade sssd-toolsUpgrade sssd-idpUpgrade python3-libipa_hbacUpgrade libsss_autofsUpgrade sssd-client | Jul 26, 2026 | Jul 20, 2026 |
| Amazon Linux Ami 2 | — | Upgrade sssd-libwbclientUpgrade libsss_certmap-develUpgrade sssd-krb5Upgrade libsss_autofsUpgrade libipa_hbac-develUpgrade sssd-clientUpgrade libsss_nss_idmap-develUpgrade sssd-commonUpgrade libsss_nss_idmapUpgrade libipa_hbacUpgrade sssd-dbusUpgrade libsss_simpleifp-develUpgrade sssd-debuginfoUpgrade libsss_certmapUpgrade sssd-kcmUpgrade sssd-common-pacUpgrade python-libipa_hbacUpgrade python-sssdconfigUpgrade libsss_idmap-develUpgrade libsss_simpleifpUpgrade sssd-libwbclient-develUpgrade sssd-polkit-rulesUpgrade sssd-toolsUpgrade sssdUpgrade sssd-krb5-commonUpgrade libsss_idmapUpgrade sssd-winbind-idmapUpgrade python-libsss_nss_idmapUpgrade libsss_sudoUpgrade sssd-ipaUpgrade sssd-adUpgrade sssd-proxyUpgrade python-sss-murmurUpgrade python-sssUpgrade sssd-ldap | Aug 5, 2026 | Aug 5, 2026 |
| Redhat Openshift | — | Upgrade rhcos | Aug 19, 2026 | Jul 7, 2026 |
| Redhat_linux | — | Upgrade sssdUpgrade sssd-adUpgrade sssd-nfs-idmapUpgrade libsss_sudoUpgrade sssd-proxyUpgrade python3-sss-debuginfoUpgrade sssd-client-debuginfoUpgrade sssd-winbind-idmap-debuginfoUpgrade python3-sss-murmur-debuginfoUpgrade sssd-winbind-idmapUpgrade python3-libsss_nss_idmapUpgrade sssd-toolsUpgrade sssd-common-debuginfoUpgrade libsss_nss_idmapUpgrade python3-libipa_hbacUpgrade sssd-debuginfoUpgrade sssd-ipa-debuginfoUpgrade libsss_autofsUpgrade sssd-tools-debuginfoUpgrade python-libipa_hbacUpgrade python3-libsss_nss_idmap-debuginfoUpgrade libsss_simpleifpUpgrade python-sssdconfigUpgrade libsss_sudo-debuginfoUpgrade libipa_hbacUpgrade libsss_idmapUpgrade sssd-passkeyUpgrade sssd-ipaUpgrade libsss_idmap-develUpgrade libsss_certmapNo solution existsUpgrade sssd-kcmUpgrade sssd-libwbclient-develUpgrade sssd-libwbclientUpgrade sssd-commonUpgrade python3-sssUpgrade sssd-idp-debuginfoUpgrade sssd-common-pac-debuginfoUpgrade sssd-krb5Upgrade sssd-dbusUpgrade python-sssUpgrade sssd-krb5-common-debuginfoUpgrade python-libsss_nss_idmapUpgrade libsss_autofs-debuginfoUpgrade libipa_hbac-debuginfoUpgrade sssd-ldapUpgrade python-sss-murmurUpgrade sssd-idpUpgrade sssd-krb5-debuginfoUpgrade sssd-common-pacUpgrade libsss_idmap-debuginfoUpgrade libsss_simpleifp-debuginfoUpgrade libsss_simpleifp-develUpgrade sssd-nfs-idmap-debuginfoUpgrade libipa_hbac-develUpgrade libsss_nss_idmap-debuginfoUpgrade sssd-clientUpgrade python3-sssdconfigUpgrade sssd-debugsourceUpgrade libsss_certmap-debuginfoUpgrade sssd-kcm-debuginfoUpgrade sssd-ad-debuginfoUpgrade python3-libipa_hbac-debuginfoUpgrade libsss_certmap-develUpgrade libsss_nss_idmap-develUpgrade sssd-proxy-debuginfoUpgrade sssd-polkit-rulesUpgrade sssd-passkey-debuginfoUpgrade sssd-dbus-debuginfoUpgrade sssd-krb5-commonUpgrade python3-sss-murmurUpgrade sssd-ldap-debuginfo | Jul 17, 2026 | Jul 7, 2026 |
| Rocky_linux | — | Upgrade sssd-ad-debuginfoUpgrade libsss_certmap-debuginfoUpgrade sssd-client-debuginfoUpgrade libsss_sudoUpgrade sssd-passkeyUpgrade sssd-nfs-idmapUpgrade libsss_simpleifp-debuginfoUpgrade sssd-winbind-idmapUpgrade sssd-common-pacUpgrade sssd-kcmUpgrade libsss_simpleifpUpgrade libsss_nss_idmap-develUpgrade python3-sss-murmur-debuginfoUpgrade python3-libsss_nss_idmapUpgrade sssd-dbusUpgrade sssd-common-debuginfoUpgrade libsss_nss_idmapUpgrade sssd-debuginfoUpgrade libsss_sudo-debuginfoUpgrade sssd-idp-debuginfoUpgrade sssd-passkey-debuginfoUpgrade sssd-nfs-idmap-debuginfoUpgrade sssd-krb5-commonUpgrade libsss_nss_idmap-debuginfoUpgrade sssd-polkit-rulesUpgrade libipa_hbacUpgrade sssd-krb5-common-debuginfoUpgrade libsss_idmap-develUpgrade python3-libipa_hbac-debuginfoUpgrade sssd-dbus-debuginfoUpgrade sssd-krb5-debuginfoUpgrade python3-libsss_nss_idmap-debuginfoUpgrade sssd-adUpgrade sssd-ipaUpgrade libipa_hbac-debuginfoUpgrade libsss_certmap-develUpgrade sssd-proxyUpgrade sssd-ldapUpgrade libsss_certmapUpgrade sssd-tools-debuginfoUpgrade libsss_idmap-debuginfoUpgrade python3-sss-murmurUpgrade sssd-ipa-debuginfoUpgrade sssd-commonUpgrade sssd-toolsUpgrade sssd-krb5Upgrade python3-sss-debuginfoUpgrade sssdUpgrade libsss_autofsUpgrade sssd-clientUpgrade sssd-winbind-idmap-debuginfoUpgrade sssd-idpUpgrade libsss_idmapUpgrade sssd-common-pac-debuginfoUpgrade sssd-kcm-debuginfoUpgrade sssd-debugsourceUpgrade python3-sssUpgrade sssd-proxy-debuginfoUpgrade sssd-ldap-debuginfoUpgrade python3-libipa_hbacUpgrade libsss_autofs-debuginfo | Jul 27, 2026 | Jul 22, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub