A path traversal flaw was found in SSSD's AD GPO provider. The ad_gpo_extract_smb_components() function does not sanitize .. sequences in the gPCFileSysPath LDAP attribute, allowing an attacker with AD GPO management access to write files outside the GPO cache directory as root. On default RHEL configurations with SELinux enforcing, this can be used to inject Kerberos configuration leading to authentication bypass.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libsss_certmapUpgrade python3-sss-murmurUpgrade sssd-dbusUpgrade sssd-clientUpgrade sssd-idpUpgrade sssd-krb5Upgrade sssd-commonUpgrade sssd-common-pacUpgrade libsss_autofsUpgrade libsss_nss_idmapUpgrade python3-libipa_hbacUpgrade sssd-toolsUpgrade python3-libsss_nss_idmapUpgrade libsss_nss_idmap-develUpgrade libsss_idmapUpgrade sssd-polkit-rulesUpgrade sssd-ldapUpgrade sssd-ipaUpgrade sssd-krb5-commonUpgrade sssd-kcmUpgrade sssdUpgrade sssd-adUpgrade libsss_sudoUpgrade sssd-proxyUpgrade python3-sssUpgrade sssd-nfs-idmapUpgrade libsss_simpleifpUpgrade libipa_hbacUpgrade python3-sssdconfigUpgrade sssd-winbind-idmap | Jul 26, 2026 | Jul 20, 2026 |
| Amazon Linux Ami 2 | — | Upgrade sssd-dbusUpgrade libipa_hbac-develUpgrade sssd-common-pacUpgrade sssd-debuginfoUpgrade sssd-commonUpgrade sssd-libwbclientUpgrade libsss_autofsUpgrade sssd-krb5Upgrade sssd-clientUpgrade libsss_certmapUpgrade libsss_nss_idmap-develUpgrade libsss_simpleifp-develUpgrade libsss_nss_idmapUpgrade libsss_certmap-develUpgrade sssd-kcmUpgrade libipa_hbacUpgrade libsss_idmap-develUpgrade sssd-ldapUpgrade python-sss-murmurUpgrade sssd-krb5-commonUpgrade sssd-ipaUpgrade python-sssUpgrade sssd-toolsUpgrade sssdUpgrade libsss_simpleifpUpgrade python-libsss_nss_idmapUpgrade libsss_sudoUpgrade sssd-proxyUpgrade sssd-polkit-rulesUpgrade python-libipa_hbacUpgrade libsss_idmapUpgrade sssd-libwbclient-develUpgrade python-sssdconfigUpgrade sssd-winbind-idmapUpgrade sssd-ad | Aug 5, 2026 | Aug 5, 2026 |
| Redhat Openshift | — | Upgrade ose-rhel-coreos | Aug 19, 2026 | Jul 7, 2026 |
| Redhat_linux | — | Upgrade python-libsss_nss_idmapUpgrade sssd-common-pac-debuginfoUpgrade sssd-idp-debuginfoUpgrade sssd-dbusUpgrade sssd-krb5Upgrade sssd-ldapUpgrade python3-sssUpgrade python-sss-murmurUpgrade sssd-krb5-commonUpgrade sssd-libwbclientUpgrade libsss_certmapNo solution existsUpgrade sssd-passkey-debuginfoUpgrade libsss_nss_idmap-debuginfoUpgrade sssd-libwbclient-develUpgrade sssd-common-pacUpgrade sssd-idpUpgrade sssd-krb5-debuginfoUpgrade sssd-commonUpgrade sssd-kcmUpgrade libsss_certmap-develUpgrade python3-sss-murmurUpgrade sssd-ldap-debuginfoUpgrade libsss_idmap-debuginfoUpgrade sssd-debugsourceUpgrade libsss_simpleifp-develUpgrade python3-sssdconfigUpgrade libsss_autofs-debuginfoUpgrade sssd-ad-debuginfoUpgrade libipa_hbac-debuginfoUpgrade python-sssUpgrade sssd-dbus-debuginfoUpgrade python3-libipa_hbac-debuginfoUpgrade libsss_certmap-debuginfoUpgrade sssd-polkit-rulesUpgrade sssd-krb5-common-debuginfoUpgrade libsss_simpleifp-debuginfoUpgrade libsss_nss_idmap-develUpgrade libipa_hbac-develUpgrade sssd-nfs-idmap-debuginfoUpgrade sssd-proxy-debuginfoUpgrade sssd-kcm-debuginfoUpgrade sssd-clientUpgrade sssd-winbind-idmap-debuginfoUpgrade sssd-winbind-idmapUpgrade libsss_idmap-develUpgrade python-sssdconfigUpgrade sssd-tools-debuginfoUpgrade libsss_simpleifpUpgrade python3-libsss_nss_idmapUpgrade libipa_hbacUpgrade libsss_nss_idmapUpgrade sssd-toolsUpgrade sssd-client-debuginfoUpgrade libsss_idmapUpgrade python3-libipa_hbacUpgrade sssd-common-debuginfoUpgrade sssd-debuginfoUpgrade sssd-passkeyUpgrade libsss_autofsUpgrade sssd-ipa-debuginfoUpgrade python3-libsss_nss_idmap-debuginfoUpgrade sssd-nfs-idmapUpgrade sssd-ipaUpgrade python3-sss-debuginfoUpgrade libsss_sudoUpgrade python-libipa_hbacUpgrade sssd-adUpgrade sssdUpgrade python3-sss-murmur-debuginfoUpgrade sssd-proxyUpgrade libsss_sudo-debuginfo | Jul 17, 2026 | Jul 7, 2026 |
| Rocky_linux | — | Upgrade python3-libsss_nss_idmapUpgrade libipa_hbac-debuginfoUpgrade libsss_idmap-develUpgrade python3-libipa_hbac-debuginfoUpgrade libsss_nss_idmapUpgrade sssd-idp-debuginfoUpgrade sssd-ipaUpgrade sssd-common-debuginfoUpgrade sssd-krb5-debuginfoUpgrade sssd-dbus-debuginfoUpgrade sssd-winbind-idmapUpgrade libsss_nss_idmap-develUpgrade sssd-nfs-idmapUpgrade sssd-dbusUpgrade sssd-kcmUpgrade sssd-debuginfoUpgrade sssd-common-pacUpgrade python3-sss-murmur-debuginfoUpgrade sssd-passkeyUpgrade sssd-krb5-commonUpgrade sssd-krb5-common-debuginfoUpgrade sssd-polkit-rulesUpgrade sssd-adUpgrade libsss_sudoUpgrade sssd-client-debuginfoUpgrade libsss_simpleifp-debuginfoUpgrade sssd-passkey-debuginfoUpgrade libsss_certmap-debuginfoUpgrade libsss_simpleifpUpgrade libsss_nss_idmap-debuginfoUpgrade libipa_hbacUpgrade libsss_sudo-debuginfoUpgrade libsss_certmap-develUpgrade python3-libsss_nss_idmap-debuginfoUpgrade sssd-nfs-idmap-debuginfoUpgrade sssd-ad-debuginfoUpgrade sssd-kcm-debuginfoUpgrade sssd-tools-debuginfoUpgrade sssd-ldap-debuginfoUpgrade python3-libipa_hbacUpgrade libsss_autofs-debuginfoUpgrade libsss_idmapUpgrade python3-sss-debuginfoUpgrade python3-sss-murmurUpgrade libsss_idmap-debuginfoUpgrade sssd-toolsUpgrade sssd-krb5Upgrade sssd-ipa-debuginfoUpgrade sssd-commonUpgrade sssd-proxyUpgrade sssd-ldapUpgrade sssd-clientUpgrade sssd-debugsourceUpgrade sssd-proxy-debuginfoUpgrade sssd-common-pac-debuginfoUpgrade python3-sssUpgrade sssdUpgrade libsss_autofsUpgrade sssd-winbind-idmap-debuginfoUpgrade sssd-idpUpgrade libsss_certmap | Jul 27, 2026 | Jul 22, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub