Debian Sssd vulnerabilities

CVE-2025-11561 [HIGH] CVE-2025-11561: sssd - A flaw was found in the integration of Active Directory and the System Security ... A flaw was found in the integration of Active Directory and the System Security Services Daemon (SSSD) on Linux systems. In default configurations, the Kerberos local authentication plugin (sssd_krb5_localauth_plugin) is enabled, but a fallback to the an2ln plugin is possible. This fallback allows an attacker with permission to modify certain AD attributes (such as use

CVE-2023-3758 [HIGH] CVE-2023-3758: sssd - A race condition flaw was found in sssd where the GPO policy is not consistently... A race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated users. This may lead to improper authorization issues, granting or denying access to resources inappropriately. Scope: local bookworm: resolved (fixed in 2.8.2-4+deb12u1) bullseye: resolved (fixed in 2.4.1-2+deb11u1) forky: resolved (fixed in 2.9.5-1) sid: resolved

CVE-2022-4254 [HIGH] CVE-2022-4254: sssd - sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters Scope: local bookworm: resolved (fixed in 2.3.1-1) bullseye: resolved (fixed in 2.3.1-1) forky: resolved (fixed in 2.3.1-1) sid: resolved (fixed in 2.3.1-1) trixie: resolved (fixed in 2.3.1-1)

CVE-2021-3621 [HIGH] CVE-2021-3621: sssd - A flaw was found in SSSD, where the sssctl command was vulnerable to shell comma... A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cache-expire subcommands. This flaw allows an attacker to trick the root user into running a specially crafted sssctl command, such as via sudo, to gain root access. The highest threat from this vulnerability is to confidentiality, integrity, as well as sys

CVE-2019-3811 [MEDIUM] CVE-2019-3811: sssd - A vulnerability was found in sssd. If a user was configured with no home directo... A vulnerability was found in sssd. If a user was configured with no home directory set, sssd would return '/' (the root directory) instead of '' (the empty string / no home directory). This could impact services that restrict the user's filesystem access to within their home directory through chroot() etc. All versions before 2.1 are vulnerable. Scope: local bookworm:

CVE-2018-16838 [MEDIUM] CVE-2018-16838: sssd - A flaw was found in sssd Group Policy Objects implementation. When the GPO is no... A flaw was found in sssd Group Policy Objects implementation. When the GPO is not readable by SSSD due to a too strict permission settings on the server side, SSSD will allow all authenticated users to login instead of denying access. Scope: local bookworm: resolved (fixed in 2.2.0-1) bullseye: resolved (fixed in 2.2.0-1) forky: resolved (fixed in 2.2.0-1) sid: resol

CVE-2018-16883 [LOW] CVE-2018-16883: sssd - sssd versions from 1.13.0 to before 2.0.0 did not properly restrict access to th... sssd versions from 1.13.0 to before 2.0.0 did not properly restrict access to the infopipe according to the "allowed_uids" configuration parameter. If sensitive information were stored in the user directory, this could be inadvertently disclosed to local attackers. Scope: local bookworm: resolved (fixed in 2.2.0-1) bullseye: resolved (fixed in 2.2.0-1) forky: resolved (

CVE-2018-10852 [LOW] CVE-2018-10852: sssd - The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules ... The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD has too wide permissions, which means that anyone who can send a message using the same raw protocol that sudo and SSSD use can read the sudo rules available for any user. This affects versions of SSSD before 1.16.3. Scope: local bookworm: resolved (fixed in 1.16.3-1) bullseye: res

CVE-2017-12173 [MEDIUM] CVE-2017-12173: sssd - It was found that sssd's sysdb_search_user_by_upn_res() function before 1.16.0 d... It was found that sssd's sysdb_search_user_by_upn_res() function before 1.16.0 did not sanitize requests when querying its local cache and was vulnerable to injection. In a centralized login environment, if a password hash was locally cached for a given user, an authenticated attacker could use this flaw to retrieve it. Scope: local bookworm: resolved (fixed in 1.15.

CVE-2015-5292 [MEDIUM] CVE-2015-5292: sssd - Memory leak in the Privilege Attribute Certificate (PAC) responder plugin (sssd_... Memory leak in the Privilege Attribute Certificate (PAC) responder plugin (sssd_pac_plugin.so) in System Security Services Daemon (SSSD) 1.10 before 1.13.1 allows remote authenticated users to cause a denial of service (memory consumption) via a large number of logins that trigger parsing of PAC blobs during Kerberos authentication. Scope: local bookworm: resolved (fix

CVE-2014-0249 [LOW] CVE-2014-0249: sssd - The System Security Services Daemon (SSSD) 1.11.6 does not properly identify gro... The System Security Services Daemon (SSSD) 1.11.6 does not properly identify group membership when a non-POSIX group is in a group membership chain, which allows local users to bypass access restrictions via unspecified vectors. Scope: local bookworm: resolved (fixed in 1.11.7-1) bullseye: resolved (fixed in 1.11.7-1) forky: resolved (fixed in 1.11.7-1) sid: resolved (fix

CVE-2013-0220 [MEDIUM] CVE-2013-0220: sssd - The (1) sss_autofs_cmd_getautomntent and (2) sss_autofs_cmd_getautomntbyname fun... The (1) sss_autofs_cmd_getautomntent and (2) sss_autofs_cmd_getautomntbyname function in responder/autofs/autofssrv_cmd.c and the (3) ssh_cmd_parse_request function in responder/ssh/sshsrv_cmd.c in System Security Services Daemon (SSSD) before 1.9.4 allow remote attackers to cause a denial of service (out-of-bounds read, crash, and restart) via a crafted SSSD packet. S

CVE-2013-0219 [LOW] CVE-2013-0219: sssd - System Security Services Daemon (SSSD) before 1.9.4, when (1) creating, (2) copy... System Security Services Daemon (SSSD) before 1.9.4, when (1) creating, (2) copying, or (3) removing a user home directory tree, allows local users to create, modify, or delete arbitrary files via a symlink attack on another user's files. Scope: local bookworm: resolved (fixed in 1.8.4-2) bullseye: resolved (fixed in 1.8.4-2) forky: resolved (fixed in 1.8.4-2) sid: resolv

CVE-2013-0287 [MEDIUM] CVE-2013-0287: sssd - The Simple Access Provider in System Security Services Daemon (SSSD) 1.9.0 throu... The Simple Access Provider in System Security Services Daemon (SSSD) 1.9.0 through 1.9.4, when the Active Directory provider is used, does not properly enforce the simple_deny_groups option, which allows remote authenticated users to bypass intended access restrictions. Scope: local bookworm: resolved bullseye: resolved forky: resolved sid: resolved trixie: resolved

CVE-2012-3462 [HIGH] CVE-2012-3462: sssd - A flaw was found in SSSD version 1.9.0. The SSSD's access-provider logic causes ... A flaw was found in SSSD version 1.9.0. The SSSD's access-provider logic causes the result of the HBAC rule processing to be ignored in the event that the access-provider is also handling the setup of the user's SELinux user context. Scope: local bookworm: resolved (fixed in 1.10.0-1) bullseye: resolved (fixed in 1.10.0-1) forky: resolved (fixed in 1.10.0-1) sid: resolve

CVE-2011-1758 [LOW] CVE-2011-1758: sssd - The krb5_save_ccname_done function in providers/krb5/krb5_auth.c in System Secur... The krb5_save_ccname_done function in providers/krb5/krb5_auth.c in System Security Services Daemon (SSSD) 1.5.x before 1.5.7, when automatic ticket renewal and offline authentication are configured, uses a pathname string as a password, which allows local users to bypass Kerberos authentication by listing the /tmp directory to obtain the pathname. Scope: local bookworm:

CVE-2010-2940 [MEDIUM] CVE-2010-2940: sssd - The auth_send function in providers/ldap/ldap_auth.c in System Security Services... The auth_send function in providers/ldap/ldap_auth.c in System Security Services Daemon (SSSD) 1.3.0, when LDAP authentication and anonymous bind are enabled, allows remote attackers to bypass the authentication requirements of pam_authenticate via an empty password. Scope: local bookworm: resolved (fixed in 1.2.1-4) bullseye: resolved (fixed in 1.2.1-4) forky: resolve

CVE-2010-4341 [LOW] CVE-2010-4341: sssd - The pam_parse_in_data_v2 function in src/responder/pam/pamsrv_cmd.c in the PAM r... The pam_parse_in_data_v2 function in src/responder/pam/pamsrv_cmd.c in the PAM responder in SSSD 1.5.0, 1.4.x, and 1.3 allows local users to cause a denial of service (infinite loop, crash, and login prevention) via a crafted packet. Scope: local bookworm: resolved (fixed in 1.2.1-4.1) bullseye: resolved (fixed in 1.2.1-4.1) forky: resolved (fixed in 1.2.1-4.1) sid: resol

CVE-2010-0014 [LOW] CVE-2010-0014: sssd - System Security Services Daemon (SSSD) before 1.0.1, when the krb5 auth_provider... System Security Services Daemon (SSSD) before 1.0.1, when the krb5 auth_provider is configured but the KDC is unreachable, allows physically proximate attackers to authenticate, via an arbitrary password, to the screen-locking program on a workstation that has any user's Kerberos ticket-granting ticket (TGT); and might allow remote attackers to bypass intended access rest

CVE-2009-2410 [HIGH] CVE-2009-2410: sssd - The local_handler_callback function in server/responder/pam/pam_LOCAL_domain.c i... The local_handler_callback function in server/responder/pam/pam_LOCAL_domain.c in sssd 0.4.1 does not properly handle blank-password accounts in the SSSD BE database, which allows context-dependent attackers to obtain access by sending the account's username, in conjunction with an arbitrary password, over an ssh connection. Scope: local bookworm: resolved bullseye: reso