Memory leak in the Privilege Attribute Certificate (PAC) responder plugin (sssd_pac_plugin.so) in System Security Services Daemon (SSSD) 1.10 before 1.13.1 allows remote authenticated users to cause a denial of service (memory consumption) via a large number of logins that trigger parsing of PAC blobs during Kerberos authentication.
CVSS Details
- CVSS 3.1 Base Score: 6.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade libsss_nss_idmap-develUpgrade sssd-clientUpgrade libsss_simpleifp-develUpgrade libipa_hbac-pythonUpgrade libipa_hbac-develUpgrade sssd-krb5Upgrade libipa_hbacUpgrade libsss_nss_idmapUpgrade sssd-common-pacUpgrade sssd-dbusUpgrade sssd-commonUpgrade libsss_nss_idmap-pythonUpgrade python-sssdconfigUpgrade sssd-ipaUpgrade sssd-proxyUpgrade sssd-adUpgrade sssd-ldapUpgrade libsss_idmapUpgrade libsss_simpleifpUpgrade sssdUpgrade sssd-toolsUpgrade libsss_idmap-develUpgrade sssd-krb5-common | Dec 1, 2016 | Oct 29, 2015 |
| Debian | — | Upgrade sssd | Jul 30, 2024 | Oct 29, 2015 |
| Oracle_linux | — | Upgrade python-sssUpgrade sssdUpgrade sssd-adUpgrade python-sss-murmurUpgrade libsss_idmap-develUpgrade sssd-ipaUpgrade libsss_simpleifpUpgrade sssd-krb5Upgrade libsss_nss_idmapUpgrade python-libsss_nss_idmapUpgrade sssd-libwbclient-develUpgrade sssd-krb5-commonUpgrade sssd-proxyUpgrade python-sssdconfigUpgrade sssd-clientUpgrade sssd-toolsUpgrade libsss_simpleifp-develUpgrade sssd-ldapUpgrade sssd-common-pacUpgrade sssd-libwbclientUpgrade sssd-commonUpgrade libsss_idmapUpgrade libipa_hbacUpgrade libsss_nss_idmap-develUpgrade libipa_hbac-develUpgrade sssd-dbusUpgrade python-libipa_hbac | Oct 16, 2024 | Oct 29, 2015 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Sep 23, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub