A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cache-expire subcommands. This flaw allows an attacker to trick the root user into running a specially crafted sssctl command, such as via sudo, to gain root access. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libsss_nss_idmap-devel | May 4, 2022 | Dec 23, 2021 |
| Amazon Linux Ami 2 | — | Upgrade libsss_certmapUpgrade libipa_hbacUpgrade sssd-ipaUpgrade libsss_simpleifpUpgrade libsss_nss_idmapUpgrade python-sssUpgrade sssd-proxyUpgrade sssd-debuginfoUpgrade sssd-krb5Upgrade libsss_sudoUpgrade sssd-clientUpgrade sssdUpgrade sssd-polkit-rulesUpgrade sssd-commonUpgrade libsss_idmapUpgrade sssd-libwbclientUpgrade sssd-dbusUpgrade libsss_simpleifp-develUpgrade libsss_autofsUpgrade sssd-kcmUpgrade python-libipa_hbacUpgrade libsss_idmap-develUpgrade libsss_certmap-develUpgrade sssd-toolsUpgrade sssd-libwbclient-develUpgrade sssd-winbind-idmapUpgrade python-libsss_nss_idmapUpgrade libipa_hbac-develUpgrade sssd-ldapUpgrade sssd-krb5-commonUpgrade sssd-common-pacUpgrade python-sss-murmurUpgrade sssd-adUpgrade python-sssdconfigUpgrade libsss_nss_idmap-devel | Oct 7, 2021 | Oct 7, 2021 |
| Amazon_linux | — | Upgrade sssd | Oct 5, 2021 | Aug 17, 2021 |
| Centos_linux | — | Upgrade sssd-commonUpgrade libsss_idmap-develUpgrade python-libipa_hbacUpgrade sssd-dbusUpgrade sssd-ipa-debuginfoUpgrade libsss_nss_idmap-develUpgrade sssd-polkit-rulesUpgrade libsss_idmap-debuginfoUpgrade libsss_nss_idmapUpgrade python3-sss-debuginfoUpgrade sssd-ad-debuginfoUpgrade sssd-client-debuginfoUpgrade sssd-common-debuginfoUpgrade sssd-krb5-common-debuginfoUpgrade python3-libsss_nss_idmap-debuginfoUpgrade libsss_idmapUpgrade sssd-nfs-idmap-debuginfoUpgrade sssd-winbind-idmapUpgrade libsss_simpleifp-debuginfoUpgrade sssd-winbind-idmap-debuginfoUpgrade sssd-dbus-debuginfoUpgrade python-sssUpgrade sssd-ipaUpgrade libipa_hbac-debuginfoUpgrade libsss_certmap-debuginfoUpgrade libsss_sudoUpgrade python3-sssdconfigUpgrade sssd-libwbclientUpgrade sssd-debuginfoUpgrade libsss_nss_idmap-debuginfoUpgrade sssd-clientUpgrade python-sssdconfigUpgrade python3-libipa_hbacUpgrade sssd-common-pac-debuginfoUpgrade libipa_hbacUpgrade sssd-common-pacUpgrade libipa_hbac-develUpgrade python3-sss-murmurUpgrade python3-sss-murmur-debuginfoUpgrade python3-sssUpgrade sssd-kcm-debuginfoUpgrade python-libsss_nss_idmapUpgrade sssd-ldap-debuginfoUpgrade libsss_autofs-debuginfoUpgrade sssd-nfs-idmapUpgrade sssdUpgrade libsss_certmapUpgrade libsss_sudo-debuginfoUpgrade sssd-proxyUpgrade sssd-toolsUpgrade python3-libipa_hbac-debuginfoUpgrade sssd-debugsourceUpgrade libsss_simpleifp-develUpgrade sssd-tools-debuginfoUpgrade libsss_autofsUpgrade sssd-libwbclient-debuginfoUpgrade libsss_certmap-develUpgrade sssd-proxy-debuginfoUpgrade sssd-krb5Upgrade libsss_simpleifpUpgrade sssd-krb5-commonUpgrade sssd-ldapUpgrade python-sss-murmurUpgrade sssd-kcmUpgrade sssd-adUpgrade python3-libsss_nss_idmapUpgrade sssd-libwbclient-develUpgrade sssd-krb5-debuginfo | Aug 17, 2021 | Aug 16, 2021 |
| Debian | — | Upgrade sssd | Sep 17, 2021 | Sep 17, 2021 |
| Gentoo Linux | — | Upgrade sys-auth/sssd. | Jul 3, 2024 | Dec 23, 2021 |
| Huawei Euleros 2_0_sp5 | — | Upgrade libsss_autofsUpgrade libsss_simpleifpUpgrade sssd-krb5Upgrade sssd-clientUpgrade sssd-libwbclientUpgrade libsss_nss_idmapUpgrade sssd-toolsUpgrade libsss_idmapUpgrade sssd-proxyUpgrade sssd-commonUpgrade python-sssUpgrade python-libsss_nss_idmapUpgrade libsss_certmapUpgrade sssdUpgrade python-libipa_hbacUpgrade sssd-ldapUpgrade sssd-dbusUpgrade python-sssdconfigUpgrade python-sss-murmurUpgrade sssd-common-pacUpgrade sssd-ipaUpgrade sssd-krb5-commonUpgrade sssd-adUpgrade libsss_sudoUpgrade libipa_hbac | Nov 12, 2021 | Nov 2, 2021 |
| Huawei Euleros 2_0_sp8 | — | Upgrade sssd-common-pacUpgrade python2-sssdconfigUpgrade sssdUpgrade sssd-commonUpgrade sssd-winbind-idmapUpgrade sssd-toolsUpgrade sssd-krb5-commonUpgrade sssd-dbusUpgrade sssd-ldapUpgrade libsss_idmapUpgrade python3-sssUpgrade sssd-kcmUpgrade sssd-adUpgrade sssd-krb5Upgrade python2-sssUpgrade python2-libipa_hbacUpgrade libsss_autofsUpgrade python3-sss-murmurUpgrade sssd-ipaUpgrade libsss_sudoUpgrade libsss_certmapUpgrade libsss_simpleifpUpgrade python2-sss-murmurUpgrade python3-sssdconfigUpgrade python3-libipa_hbacUpgrade libsss_nss_idmapUpgrade sssd-proxyUpgrade python3-libsss_nss_idmapUpgrade libipa_hbacUpgrade sssd-libwbclientUpgrade sssd-nfs-idmapUpgrade sssd-clientUpgrade python2-libsss_nss_idmap | Nov 2, 2021 | Nov 2, 2021 |
| Huawei Euleros 2_0_sp9 | — | Upgrade sssdUpgrade python3-sssd | Nov 12, 2021 | Nov 2, 2021 |
| Oracle_linux | — | Upgrade sssd-clientUpgrade python3-sssdconfigUpgrade libsss_certmapUpgrade sssdUpgrade libsss_idmap-develUpgrade python-sssdconfigUpgrade libsss_certmap-develUpgrade sssd-krb5Upgrade sssd-kcmUpgrade libipa_hbacUpgrade python3-libsss_nss_idmapUpgrade sssd-ipaUpgrade python-sssUpgrade libsss_sudoUpgrade sssd-nfs-idmapUpgrade libipa_hbac-develUpgrade libsss_nss_idmapUpgrade libsss_simpleifpUpgrade sssd-polkit-rulesUpgrade sssd-common-pacUpgrade libsss_idmapUpgrade sssd-ldapUpgrade python-sss-murmurUpgrade libsss_nss_idmap-develUpgrade python3-libipa_hbacUpgrade sssd-krb5-commonUpgrade sssd-libwbclientUpgrade sssd-dbusUpgrade python-libipa_hbacUpgrade libsss_simpleifp-develUpgrade sssd-commonUpgrade python3-sss-murmurUpgrade python-libsss_nss_idmapUpgrade sssd-adUpgrade sssd-toolsUpgrade libsss_autofsUpgrade sssd-proxyUpgrade python3-sssUpgrade sssd-libwbclient-develUpgrade sssd-winbind-idmap | Aug 17, 2021 | Aug 16, 2021 |
| Redhat_linux | — | Upgrade libipa_hbac-develUpgrade sssd-client-debuginfoUpgrade python-libsss_nss_idmapUpgrade libsss_nss_idmap-debuginfoUpgrade sssd-polkit-rulesUpgrade sssd-libwbclient-debuginfoUpgrade sssd-libwbclient-develUpgrade sssd-adUpgrade sssd-kcmUpgrade python-libipa_hbacUpgrade libsss_simpleifp-develUpgrade sssdUpgrade python-sssUpgrade libsss_sudo-debuginfoUpgrade sssd-krb5-debuginfoUpgrade sssd-ldapUpgrade python3-libsss_nss_idmap-debuginfoUpgrade libsss_idmap-develUpgrade sssd-ipaUpgrade python-sssdconfigUpgrade sssd-kcm-debuginfoUpgrade sssd-winbind-idmapUpgrade libsss_nss_idmap-develUpgrade python3-libsss_nss_idmapUpgrade python3-sssUpgrade libsss_idmap-debuginfoUpgrade libsss_simpleifpUpgrade python-sss-murmurUpgrade sssd-common-pac-debuginfoUpgrade sssd-krb5-commonUpgrade libsss_certmap-develUpgrade libipa_hbac-debuginfoUpgrade python3-sss-murmur-debuginfoUpgrade sssd-winbind-idmap-debuginfoUpgrade sssd-ipa-debuginfoNo solution existsUpgrade libsss_sudoUpgrade python3-libipa_hbac-debuginfoUpgrade sssd-common-pacUpgrade python3-sss-murmurUpgrade sssd-krb5Upgrade sssd-common-debuginfoUpgrade python3-sssdconfigUpgrade sssd-toolsUpgrade sssd-proxy-debuginfoUpgrade sssd-dbus-debuginfoUpgrade sssd-tools-debuginfoUpgrade libsss_certmapUpgrade sssd-clientUpgrade libsss_nss_idmapUpgrade sssd-nfs-idmapUpgrade libsss_certmap-debuginfoUpgrade sssd-ldap-debuginfoUpgrade python3-libipa_hbacUpgrade sssd-proxyUpgrade libsss_idmapUpgrade sssd-debuginfoUpgrade libsss_simpleifp-debuginfoUpgrade sssd-krb5-common-debuginfoUpgrade sssd-debugsourceUpgrade sssd-dbusUpgrade libsss_autofs-debuginfoUpgrade sssd-commonUpgrade libsss_autofsUpgrade python3-sss-debuginfoUpgrade sssd-ad-debuginfoUpgrade sssd-libwbclientUpgrade sssd-nfs-idmap-debuginfoUpgrade libipa_hbac | Aug 17, 2021 | Aug 16, 2021 |
| Rocky_linux | — | Upgrade sssdUpgrade sssd-ipa-debuginfoUpgrade sssd-winbind-idmap-debuginfoUpgrade sssd-debuginfoUpgrade sssd-dbus-debuginfoUpgrade sssd-winbind-idmapUpgrade sssd-toolsUpgrade libsss_sudo-debuginfoUpgrade sssd-tools-debuginfoUpgrade sssd-libwbclientUpgrade sssd-common-debuginfoUpgrade sssd-proxyUpgrade libsss_nss_idmapUpgrade sssd-ad-debuginfoUpgrade sssd-proxy-debuginfoUpgrade python3-libipa_hbacUpgrade sssd-nfs-idmap-debuginfoUpgrade sssd-clientUpgrade python3-libsss_nss_idmapUpgrade python3-libsss_nss_idmap-debuginfoUpgrade sssd-nfs-idmapUpgrade python3-sss-debuginfoUpgrade libsss_simpleifpUpgrade libsss_autofsUpgrade sssd-debugsourceUpgrade sssd-krb5-common-debuginfoUpgrade sssd-krb5Upgrade libsss_idmapUpgrade libsss_sudoUpgrade libsss_certmap-debuginfoUpgrade python3-sss-murmurUpgrade python3-sssUpgrade sssd-common-pacUpgrade libsss_idmap-debuginfoUpgrade sssd-polkit-rulesUpgrade sssd-krb5-debuginfoUpgrade sssd-ldapUpgrade sssd-libwbclient-debuginfoUpgrade libipa_hbacUpgrade python3-libipa_hbac-debuginfoUpgrade sssd-client-debuginfoUpgrade libsss_nss_idmap-develUpgrade sssd-ldap-debuginfoUpgrade sssd-kcm-debuginfoUpgrade libsss_certmapUpgrade sssd-krb5-commonUpgrade sssd-kcmUpgrade sssd-dbusUpgrade sssd-adUpgrade libsss_nss_idmap-debuginfoUpgrade libipa_hbac-debuginfoUpgrade libsss_simpleifp-debuginfoUpgrade sssd-common-pac-debuginfoUpgrade libsss_autofs-debuginfoUpgrade sssd-ipaUpgrade sssd-commonUpgrade python3-sss-murmur-debuginfo | May 5, 2022 | Dec 23, 2021 |
| Suse | — | Upgrade sssd-winbind-idmapUpgrade libsss_nss_idmap0Upgrade sssd-ipaUpgrade sssd-toolsUpgrade libsss_simpleifp0Upgrade sssdUpgrade sssd-adUpgrade libipa_hbac0Upgrade python3-sssd-configUpgrade python3-ipa_hbacUpgrade sssd-32bitUpgrade libsss_idmap-develUpgrade sssd-proxyUpgrade sssd-wbclientUpgrade python-sssd-configUpgrade sssd-krb5-commonUpgrade sssd-ldapUpgrade libsss_nss_idmap-develUpgrade sssd-commonUpgrade libsss_simpleifp-develUpgrade sssd-dbusUpgrade libsss_certmap0Upgrade libsss_idmap0Upgrade libnfsidmap-sssUpgrade python3-sss_nss_idmapUpgrade sssd-common-32bitUpgrade libipa_hbac-develUpgrade sssd-krb5Upgrade libsss_certmap-develUpgrade sssd-kcmUpgrade sssd-wbclient-develUpgrade python3-sss-murmur | Aug 31, 2021 | Aug 17, 2021 |
| Ubuntu | — | Upgrade sssd | Sep 9, 2021 | Aug 17, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub