Debian alert DLA-4047-1 (sssd)

From:
             
 
Guilhem Moulin <guilhem@debian.org>
To:
             
 
debian-lts-announce@lists.debian.org
Subject:
             
 
[SECURITY] [DLA 4047-1] sssd security update
Date:
             
 
Sun, 09 Feb 2025 12:55:15 +0100
Message-ID:
             
 
<Z6iXo73VkKTWnN3A@debian.org>
-------------------------------------------------------------------------
Debian LTS Advisory DLA-4047-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                       Guilhem Moulin
February 09, 2025                             https://wiki.debian.org/LTS
-------------------------------------------------------------------------

Package        : sssd
Version        : 2.4.1-2+deb11u1
CVE ID         : CVE-2021-3621 CVE-2023-3758
Debian Bug     : 992710 1070369

Vulnerabilities were found in sssd, a set of daemons to manage access to
remote directories and authentication mechanisms, which could lead to
privilege escalation.

CVE-2021-3621

    It was discovered that the sssctl(8) command was vulnerable to shell
    command injection via the ‘logs-fetch’ and ‘cache-expire’
    subcommands.

    This flaw could allows an attacker to trick the root user into
    running a specially crafted sssctl(8) command, such as via sudo, in
    order to gain root privileges.

CVE-2023-3758

    A race condition flaw was found in SSSD where the GPO policy is not
    consistently applied for authenticated users.  This may lead to
    improper authorization issues, granting access to resources
    inappropriately.

For Debian 11 bullseye, these problems have been fixed in version
2.4.1-2+deb11u1.

We recommend that you upgrade your sssd packages.

For the detailed security status of sssd please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/sssd

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEERpy6p3b9sfzUdbME05pJnDwhpVIFAmeol6MACgkQ05pJnDwh
pVK2/w//X2+Uddrrk5EZXGXFs1BvTBbQIhtYW7a6QWIG6mLcBIkwV8JzlURLJ4tL
x8Onq5gr3skM/9nk644lRqXonPXV1ZxmBkeIXa7xCJcw+46wtZbMI/CIbFZ4M1IV
FMsG6kk7h5kgzog6pua4cnJfV3ffecXfvv9npRloWbit+DRxEOKlAmJK+pCE7ZLR
wYlXh0sH0Kh4P0I2d1ZxS//FSLKv9l5A4xrcDtmxBc3YHZpIBSx8T901ZnEzbVcT
mXNXCpRWyn/jpfivip4eYPKvzgntRjfCny2L8wRnKKcZvCIxGMVyZ10AShoU4JM/
HfLgkJGMwmtOCnlz/P4Lfftgz9p50im1a0lVOKhzcn/bDyPC0iCn1oA2/YqN/oWq
6DBHvJlpljpa+rcWQC9xo6k6KV+afebMWwqwBH/oR5fzyRGM5ABEls4DGRnksPXE
NLNP9NjSs+UuG9DTwp4dL/9QppkrDZApQvkeoHzQMiY+LdO89eFMGaO49YcOV/qK
0+EUDHmV7KfySEHF5qbQrBwZQ/i6lLEBTvyQ3BHZ9C644I69YoavUQgN5POC+hp3
cs5/fHVT8JNDC6pcNeBSibOGcyB5d8eutK6TtCcOzFImmNZEbVeeadLTS8Vjqc28
FgvfGgYC12W+CNe3iXnlyJKGVtAqbWbXejXM5C5fSgHyLHAIQ0k=
=O9IN
-----END PGP SIGNATURE-----