Memory leak in the Privilege Attribute Certificate (PAC) responder plugin (sssd_pac_plugin.so) in System Security Services Daemon (SSSD) 1.10 before 1.13.1 allows remote authenticated users to cause a denial of service (memory consumption) via a large number of logins that trigger parsing of PAC blobs during Kerberos authentication.
CVSS Details
- CVSS 3.1 Base Score: 6.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade python-sssdconfigUpgrade libsss_simpleifpUpgrade sssd-adUpgrade libsss_idmap-develUpgrade sssd-ipaUpgrade sssd-proxyUpgrade sssd-ldapUpgrade sssd-toolsUpgrade sssd-krb5-commonUpgrade libsss_nss_idmap-pythonUpgrade libsss_idmapUpgrade sssdUpgrade sssd-commonUpgrade sssd-clientUpgrade libsss_simpleifp-develUpgrade libsss_nss_idmap-develUpgrade libipa_hbac-pythonUpgrade libsss_nss_idmapUpgrade libipa_hbac-develUpgrade libipa_hbacUpgrade sssd-krb5Upgrade sssd-dbusUpgrade sssd-common-pac | Dec 1, 2016 | Oct 29, 2015 |
| Debian | — | Upgrade sssd | Jul 30, 2024 | Oct 29, 2015 |
| Oracle_linux | — | Upgrade python-sssUpgrade sssd-ipaUpgrade sssd-krb5-commonUpgrade sssd-proxyUpgrade python-sssdconfigUpgrade sssd-adUpgrade sssd-krb5Upgrade sssdUpgrade libsss_idmap-develUpgrade python-sss-murmurUpgrade python-libsss_nss_idmapUpgrade sssd-libwbclient-develUpgrade libsss_simpleifpUpgrade libsss_nss_idmapUpgrade libsss_simpleifp-develUpgrade sssd-toolsUpgrade python-libipa_hbacUpgrade libsss_idmapUpgrade sssd-dbusUpgrade libipa_hbac-develUpgrade libipa_hbacUpgrade sssd-common-pacUpgrade sssd-commonUpgrade sssd-libwbclientUpgrade sssd-ldapUpgrade sssd-clientUpgrade libsss_nss_idmap-devel | Oct 16, 2024 | Oct 29, 2015 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Sep 23, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub