-------------------------------------------------------------------------
Debian LTS Advisory DLA-4047-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Guilhem Moulin
February 09, 2025 https://wiki.debian.org/LTS
-------------------------------------------------------------------------
Package : sssd
Version : 2.4.1-2+deb11u1
CVE ID : CVE-2021-3621 CVE-2023-3758
Debian Bug : 992710 1070369
Vulnerabilities were found in sssd, a set of daemons to manage access to
remote directories and authentication mechanisms, which could lead to
privilege escalation.
CVE-2021-3621
It was discovered that the sssctl(8) command was vulnerable to shell
command injection via the ‘logs-fetch’ and ‘cache-expire’
subcommands.
This flaw could allows an attacker to trick the root user into
running a specially crafted sssctl(8) command, such as via sudo, in
order to gain root privileges.
CVE-2023-3758
A race condition flaw was found in SSSD where the GPO policy is not
consistently applied for authenticated users. This may lead to
improper authorization issues, granting access to resources
inappropriately.
For Debian 11 bullseye, these problems have been fixed in version
2.4.1-2+deb11u1.
We recommend that you upgrade your sssd packages.
For the detailed security status of sssd please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/sssd
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
Attachment:
signature.asc
Description: PGP signature