Memory leak in the Privilege Attribute Certificate (PAC) responder plugin (sssd_pac_plugin.so) in System Security Services Daemon (SSSD) 1.10 before 1.13.1 allows remote authenticated users to cause a denial of service (memory consumption) via a large number of logins that trigger parsing of PAC blobs during Kerberos authentication.
CVSS Details
- CVSS 3.1 Base Score: 6.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade libipa_hbac-pythonUpgrade libsss_nss_idmap-develUpgrade libipa_hbac-develUpgrade libipa_hbacUpgrade sssd-common-pacUpgrade libsss_simpleifp-develUpgrade sssd-clientUpgrade sssd-dbusUpgrade sssd-krb5Upgrade sssd-commonUpgrade libsss_nss_idmapUpgrade sssd-krb5-commonUpgrade sssd-ldapUpgrade sssd-toolsUpgrade libsss_idmap-develUpgrade libsss_nss_idmap-pythonUpgrade libsss_idmapUpgrade sssd-proxyUpgrade sssd-adUpgrade sssdUpgrade libsss_simpleifpUpgrade python-sssdconfigUpgrade sssd-ipa | Dec 1, 2016 | Oct 29, 2015 |
| Debian | — | Upgrade sssd | Jul 30, 2024 | Oct 29, 2015 |
| Oracle_linux | — | Upgrade sssd-proxyUpgrade sssd-krb5-commonUpgrade sssd-adUpgrade sssdUpgrade sssd-ipaUpgrade libsss_simpleifpUpgrade libsss_nss_idmapUpgrade sssd-libwbclient-develUpgrade sssd-krb5Upgrade python-sssUpgrade libsss_idmap-develUpgrade python-libsss_nss_idmapUpgrade python-sss-murmurUpgrade python-sssdconfigUpgrade sssd-ldapUpgrade sssd-libwbclientUpgrade libsss_idmapUpgrade sssd-commonUpgrade sssd-common-pacUpgrade libipa_hbac-develUpgrade libipa_hbacUpgrade python-libipa_hbacUpgrade sssd-clientUpgrade sssd-toolsUpgrade sssd-dbusUpgrade libsss_simpleifp-develUpgrade libsss_nss_idmap-devel | Oct 16, 2024 | Oct 29, 2015 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Sep 23, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub