Security update for sssd SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2019:0556-1 Final 1 1 2019-03-06T09:57:00Z current 2019-03-06T09:57:00Z 2019-03-06T09:57:00Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for sssd This update for sssd fixes the following issues: Security vulnerabilities addressed: - Fix fallback_homedir returning '/' for empty home directories (CVE-2019-3811) (bsc#1121759) - Create sockets with right permissions (bsc#1098377, CVE-2018-10852) Other bug fixes and changes: - Install logrotate configuration (bsc#1004220) - Strip whitespaces in netgroup triples (bsc#1087320) - Align systemd service file with upstream * Run interactive and change service type to notify (bsc#1120852) * Replace deprecated '-f' and use '--logger' The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2019-556,SUSE-SLE-DESKTOP-12-SP4-2019-556,SUSE-SLE-SDK-12-SP4-2019-556,SUSE-SLE-SERVER-12-SP4-2019-556 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2019/suse-su-20190556-1/ Link for SUSE-SU-2019:0556-1 https://www.suse.com/support/update/announcement/2019/suse-su-20190556-1.html E-Mail link for SUSE-SU-2019:0556-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1004220 SUSE Bug 1004220 https://bugzilla.suse.com/1087320 SUSE Bug 1087320 https://bugzilla.suse.com/1098377 SUSE Bug 1098377 https://bugzilla.suse.com/1120852 SUSE Bug 1120852 https://bugzilla.suse.com/1121759 SUSE Bug 1121759 https://www.suse.com/security/cve/CVE-2018-10852/ SUSE CVE CVE-2018-10852 page https://www.suse.com/security/cve/CVE-2019-3811/ SUSE CVE CVE-2019-3811 page SUSE Linux Enterprise Desktop 12 SP4 SUSE Linux Enterprise Server 12 SP4 SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE Linux Enterprise Software Development Kit 12 SP4 libipa_hbac-devel-1.16.1-4.3.2 libipa_hbac0-1.16.1-4.3.2 libnfsidmap-sss-1.16.1-4.3.2 libsss_certmap-devel-1.16.1-4.3.2 libsss_certmap0-1.16.1-4.3.2 libsss_idmap-devel-1.16.1-4.3.2 libsss_idmap0-1.16.1-4.3.2 libsss_nss_idmap-devel-1.16.1-4.3.2 libsss_nss_idmap0-1.16.1-4.3.2 libsss_simpleifp-devel-1.16.1-4.3.2 libsss_simpleifp0-1.16.1-4.3.2 python-ipa_hbac-1.16.1-4.3.2 python-sss-murmur-1.16.1-4.3.2 python-sss_nss_idmap-1.16.1-4.3.2 python-sssd-config-1.16.1-4.3.2 sssd-1.16.1-4.3.2 sssd-32bit-1.16.1-4.3.2 sssd-64bit-1.16.1-4.3.2 sssd-ad-1.16.1-4.3.2 sssd-dbus-1.16.1-4.3.2 sssd-ipa-1.16.1-4.3.2 sssd-krb5-1.16.1-4.3.2 sssd-krb5-common-1.16.1-4.3.2 sssd-ldap-1.16.1-4.3.2 sssd-proxy-1.16.1-4.3.2 sssd-tools-1.16.1-4.3.2 libipa_hbac0-1.16.1-4.3.2 as a component of SUSE Linux Enterprise Desktop 12 SP4 libsss_certmap0-1.16.1-4.3.2 as a component of SUSE Linux Enterprise Desktop 12 SP4 libsss_idmap0-1.16.1-4.3.2 as a component of SUSE Linux Enterprise Desktop 12 SP4 libsss_nss_idmap0-1.16.1-4.3.2 as a component of SUSE Linux Enterprise Desktop 12 SP4 libsss_simpleifp0-1.16.1-4.3.2 as a component of SUSE Linux Enterprise Desktop 12 SP4 python-sssd-config-1.16.1-4.3.2 as a component of SUSE Linux Enterprise Desktop 12 SP4 sssd-1.16.1-4.3.2 as a component of SUSE Linux Enterprise Desktop 12 SP4 sssd-32bit-1.16.1-4.3.2 as a component of SUSE Linux Enterprise Desktop 12 SP4 sssd-ad-1.16.1-4.3.2 as a component of SUSE Linux Enterprise Desktop 12 SP4 sssd-ipa-1.16.1-4.3.2 as a component of SUSE Linux Enterprise Desktop 12 SP4 sssd-krb5-1.16.1-4.3.2 as a component of SUSE Linux Enterprise Desktop 12 SP4 sssd-krb5-common-1.16.1-4.3.2 as a component of SUSE Linux Enterprise Desktop 12 SP4 sssd-ldap-1.16.1-4.3.2 as a component of SUSE Linux Enterprise Desktop 12 SP4 sssd-proxy-1.16.1-4.3.2 as a component of SUSE Linux Enterprise Desktop 12 SP4 sssd-tools-1.16.1-4.3.2 as a component of SUSE Linux Enterprise Desktop 12 SP4 libipa_hbac0-1.16.1-4.3.2 as a component of SUSE Linux Enterprise Server 12 SP4 libsss_certmap0-1.16.1-4.3.2 as a component of SUSE Linux Enterprise Server 12 SP4 libsss_idmap0-1.16.1-4.3.2 as a component of SUSE Linux Enterprise Server 12 SP4 libsss_nss_idmap0-1.16.1-4.3.2 as a component of SUSE Linux Enterprise Server 12 SP4 libsss_simpleifp0-1.16.1-4.3.2 as a component of SUSE Linux Enterprise Server 12 SP4 python-sssd-config-1.16.1-4.3.2 as a component of SUSE Linux Enterprise Server 12 SP4 sssd-1.16.1-4.3.2 as a component of SUSE Linux Enterprise Server 12 SP4 sssd-32bit-1.16.1-4.3.2 as a component of SUSE Linux Enterprise Server 12 SP4 sssd-ad-1.16.1-4.3.2 as a component of SUSE Linux Enterprise Server 12 SP4 sssd-ipa-1.16.1-4.3.2 as a component of SUSE Linux Enterprise Server 12 SP4 sssd-krb5-1.16.1-4.3.2 as a component of SUSE Linux Enterprise Server 12 SP4 sssd-krb5-common-1.16.1-4.3.2 as a component of SUSE Linux Enterprise Server 12 SP4 sssd-ldap-1.16.1-4.3.2 as a component of SUSE Linux Enterprise Server 12 SP4 sssd-proxy-1.16.1-4.3.2 as a component of SUSE Linux Enterprise Server 12 SP4 sssd-tools-1.16.1-4.3.2 as a component of SUSE Linux Enterprise Server 12 SP4 libipa_hbac0-1.16.1-4.3.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 libsss_certmap0-1.16.1-4.3.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 libsss_idmap0-1.16.1-4.3.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 libsss_nss_idmap0-1.16.1-4.3.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 libsss_simpleifp0-1.16.1-4.3.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 python-sssd-config-1.16.1-4.3.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 sssd-1.16.1-4.3.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 sssd-32bit-1.16.1-4.3.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 sssd-ad-1.16.1-4.3.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 sssd-ipa-1.16.1-4.3.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 sssd-krb5-1.16.1-4.3.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 sssd-krb5-common-1.16.1-4.3.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 sssd-ldap-1.16.1-4.3.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 sssd-proxy-1.16.1-4.3.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 sssd-tools-1.16.1-4.3.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 libipa_hbac-devel-1.16.1-4.3.2 as a component of SUSE Linux Enterprise Software Development Kit 12 SP4 libsss_idmap-devel-1.16.1-4.3.2 as a component of SUSE Linux Enterprise Software Development Kit 12 SP4 libsss_nss_idmap-devel-1.16.1-4.3.2 as a component of SUSE Linux Enterprise Software Development Kit 12 SP4 The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD has too wide permissions, which means that anyone who can send a message using the same raw protocol that sudo and SSSD use can read the sudo rules available for any user. This affects versions of SSSD before 1.16.3. CVE-2018-10852 SUSE Linux Enterprise Desktop 12 SP4:libipa_hbac0-1.16.1-4.3.2 SUSE Linux Enterprise Desktop 12 SP4:libsss_certmap0-1.16.1-4.3.2 SUSE Linux Enterprise Desktop 12 SP4:libsss_idmap0-1.16.1-4.3.2 SUSE Linux Enterprise Desktop 12 SP4:libsss_nss_idmap0-1.16.1-4.3.2 SUSE Linux Enterprise Desktop 12 SP4:libsss_simpleifp0-1.16.1-4.3.2 SUSE Linux Enterprise Desktop 12 SP4:python-sssd-config-1.16.1-4.3.2 SUSE Linux Enterprise Desktop 12 SP4:sssd-1.16.1-4.3.2 SUSE Linux Enterprise Desktop 12 SP4:sssd-32bit-1.16.1-4.3.2 SUSE Linux Enterprise Desktop 12 SP4:sssd-ad-1.16.1-4.3.2 SUSE Linux Enterprise Desktop 12 SP4:sssd-ipa-1.16.1-4.3.2 SUSE Linux Enterprise Desktop 12 SP4:sssd-krb5-1.16.1-4.3.2 SUSE Linux Enterprise Desktop 12 SP4:sssd-krb5-common-1.16.1-4.3.2 SUSE Linux Enterprise Desktop 12 SP4:sssd-ldap-1.16.1-4.3.2 SUSE Linux Enterprise Desktop 12 SP4:sssd-proxy-1.16.1-4.3.2 SUSE Linux Enterprise Desktop 12 SP4:sssd-tools-1.16.1-4.3.2 SUSE Linux Enterprise Server 12 SP4:libipa_hbac0-1.16.1-4.3.2 SUSE Linux Enterprise Server 12 SP4:libsss_certmap0-1.16.1-4.3.2 SUSE Linux Enterprise Server 12 SP4:libsss_idmap0-1.16.1-4.3.2 SUSE Linux Enterprise Server 12 SP4:libsss_nss_idmap0-1.16.1-4.3.2 SUSE Linux Enterprise Server 12 SP4:libsss_simpleifp0-1.16.1-4.3.2 SUSE Linux Enterprise Server 12 SP4:python-sssd-config-1.16.1-4.3.2 SUSE Linux Enterprise Server 12 SP4:sssd-1.16.1-4.3.2 SUSE Linux Enterprise Server 12 SP4:sssd-32bit-1.16.1-4.3.2 SUSE Linux Enterprise Server 12 SP4:sssd-ad-1.16.1-4.3.2 SUSE Linux Enterprise Server 12 SP4:sssd-ipa-1.16.1-4.3.2 SUSE Linux Enterprise Server 12 SP4:sssd-krb5-1.16.1-4.3.2 SUSE Linux Enterprise Server 12 SP4:sssd-krb5-common-1.16.1-4.3.2 SUSE Linux Enterprise Server 12 SP4:sssd-ldap-1.16.1-4.3.2 SUSE Linux Enterprise Server 12 SP4:sssd-proxy-1.16.1-4.3.2 SUSE Linux Enterprise Server 12 SP4:sssd-tools-1.16.1-4.3.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libipa_hbac0-1.16.1-4.3.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libsss_certmap0-1.16.1-4.3.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libsss_idmap0-1.16.1-4.3.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libsss_nss_idmap0-1.16.1-4.3.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libsss_simpleifp0-1.16.1-4.3.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:python-sssd-config-1.16.1-4.3.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:sssd-1.16.1-4.3.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:sssd-32bit-1.16.1-4.3.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:sssd-ad-1.16.1-4.3.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:sssd-ipa-1.16.1-4.3.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:sssd-krb5-1.16.1-4.3.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:sssd-krb5-common-1.16.1-4.3.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:sssd-ldap-1.16.1-4.3.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:sssd-proxy-1.16.1-4.3.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:sssd-tools-1.16.1-4.3.2 SUSE Linux Enterprise Software Development Kit 12 SP4:libipa_hbac-devel-1.16.1-4.3.2 SUSE Linux Enterprise Software Development Kit 12 SP4:libsss_idmap-devel-1.16.1-4.3.2 SUSE Linux Enterprise Software Development Kit 12 SP4:libsss_nss_idmap-devel-1.16.1-4.3.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20190556-1/ https://www.suse.com/security/cve/CVE-2018-10852.html CVE-2018-10852 https://bugzilla.suse.com/1098377 SUSE Bug 1098377 A vulnerability was found in sssd. If a user was configured with no home directory set, sssd would return '/' (the root directory) instead of '' (the empty string / no home directory). This could impact services that restrict the user's filesystem access to within their home directory through chroot() etc. All versions before 2.1 are vulnerable. CVE-2019-3811 SUSE Linux Enterprise Desktop 12 SP4:libipa_hbac0-1.16.1-4.3.2 SUSE Linux Enterprise Desktop 12 SP4:libsss_certmap0-1.16.1-4.3.2 SUSE Linux Enterprise Desktop 12 SP4:libsss_idmap0-1.16.1-4.3.2 SUSE Linux Enterprise Desktop 12 SP4:libsss_nss_idmap0-1.16.1-4.3.2 SUSE Linux Enterprise Desktop 12 SP4:libsss_simpleifp0-1.16.1-4.3.2 SUSE Linux Enterprise Desktop 12 SP4:python-sssd-config-1.16.1-4.3.2 SUSE Linux Enterprise Desktop 12 SP4:sssd-1.16.1-4.3.2 SUSE Linux Enterprise Desktop 12 SP4:sssd-32bit-1.16.1-4.3.2 SUSE Linux Enterprise Desktop 12 SP4:sssd-ad-1.16.1-4.3.2 SUSE Linux Enterprise Desktop 12 SP4:sssd-ipa-1.16.1-4.3.2 SUSE Linux Enterprise Desktop 12 SP4:sssd-krb5-1.16.1-4.3.2 SUSE Linux Enterprise Desktop 12 SP4:sssd-krb5-common-1.16.1-4.3.2 SUSE Linux Enterprise Desktop 12 SP4:sssd-ldap-1.16.1-4.3.2 SUSE Linux Enterprise Desktop 12 SP4:sssd-proxy-1.16.1-4.3.2 SUSE Linux Enterprise Desktop 12 SP4:sssd-tools-1.16.1-4.3.2 SUSE Linux Enterprise Server 12 SP4:libipa_hbac0-1.16.1-4.3.2 SUSE Linux Enterprise Server 12 SP4:libsss_certmap0-1.16.1-4.3.2 SUSE Linux Enterprise Server 12 SP4:libsss_idmap0-1.16.1-4.3.2 SUSE Linux Enterprise Server 12 SP4:libsss_nss_idmap0-1.16.1-4.3.2 SUSE Linux Enterprise Server 12 SP4:libsss_simpleifp0-1.16.1-4.3.2 SUSE Linux Enterprise Server 12 SP4:python-sssd-config-1.16.1-4.3.2 SUSE Linux Enterprise Server 12 SP4:sssd-1.16.1-4.3.2 SUSE Linux Enterprise Server 12 SP4:sssd-32bit-1.16.1-4.3.2 SUSE Linux Enterprise Server 12 SP4:sssd-ad-1.16.1-4.3.2 SUSE Linux Enterprise Server 12 SP4:sssd-ipa-1.16.1-4.3.2 SUSE Linux Enterprise Server 12 SP4:sssd-krb5-1.16.1-4.3.2 SUSE Linux Enterprise Server 12 SP4:sssd-krb5-common-1.16.1-4.3.2 SUSE Linux Enterprise Server 12 SP4:sssd-ldap-1.16.1-4.3.2 SUSE Linux Enterprise Server 12 SP4:sssd-proxy-1.16.1-4.3.2 SUSE Linux Enterprise Server 12 SP4:sssd-tools-1.16.1-4.3.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libipa_hbac0-1.16.1-4.3.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libsss_certmap0-1.16.1-4.3.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libsss_idmap0-1.16.1-4.3.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libsss_nss_idmap0-1.16.1-4.3.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libsss_simpleifp0-1.16.1-4.3.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:python-sssd-config-1.16.1-4.3.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:sssd-1.16.1-4.3.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:sssd-32bit-1.16.1-4.3.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:sssd-ad-1.16.1-4.3.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:sssd-ipa-1.16.1-4.3.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:sssd-krb5-1.16.1-4.3.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:sssd-krb5-common-1.16.1-4.3.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:sssd-ldap-1.16.1-4.3.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:sssd-proxy-1.16.1-4.3.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:sssd-tools-1.16.1-4.3.2 SUSE Linux Enterprise Software Development Kit 12 SP4:libipa_hbac-devel-1.16.1-4.3.2 SUSE Linux Enterprise Software Development Kit 12 SP4:libsss_idmap-devel-1.16.1-4.3.2 SUSE Linux Enterprise Software Development Kit 12 SP4:libsss_nss_idmap-devel-1.16.1-4.3.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20190556-1/ https://www.suse.com/security/cve/CVE-2019-3811.html CVE-2019-3811 https://bugzilla.suse.com/1121759 SUSE Bug 1121759