CVE-2021-3621

CWE-77 — Command InjectionCWE-78 — OS Command Injection7 documents7 sources
Severity
8.8HIGH
EPSS
0.4%
top 40.35%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
8
Fedoraproject FedoraFedoraproject SssdRedhat Enterprise Linux+5 more
Timeline
PublishedDec 23
Latest updateDec 24

Description

A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cache-expire subcommands. This flaw allows an attacker to trick the root user into running a specially crafted sssctl command, such as via sudo, to gain root access. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages5 packages

▶Debiansssd< 2.4.1-2+deb11u1+3
▶CVEListV5sssdsssd 2.6.0

Also affects: Fedora 34, Enterprise Linux 6.0, 7.0, 8.0, 8.1, 8.2, 8.4

Patches

Patch: bugzilla.redhat.com ↗Patch: bugzilla.redhat.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-g527-g4q2-57xc: A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cache-expire subcommands↗2021-12-24
▶
OSV
CVE-2021-3621: A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cache-expire subcommands↗2021-12-23
▶
CVEList
CVE-2021-3621: A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cache-expire subcommands↗2021-12-23
▶

📋Vendor Advisories

3
Ubuntu
SSSD vulnerabilities↗2021-09-08
▶
Red Hat
sssd: shell command injection in sssctl↗2021-08-16
▶
Debian
CVE-2021-3621: sssd - A flaw was found in SSSD, where the sssctl command was vulnerable to shell comma...↗2021
▶