Security update for sssd SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:1258-1 Final 1 1 2022-04-19T09:04:57Z current 2022-04-19T09:04:57Z 2022-04-19T09:04:57Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for sssd This update for sssd fixes the following issues: - CVE-2021-3621: Fixed shell command injection in sssctl via the logs-fetch and cache-expire subcommands (bsc#1189492). - Add LDAPS support for the AD provider (bsc#1183735)(jsc#SLE-17773). Non-security fixes: - Fixed a crash caused by calling dbus_watch_handle with a corrupted memory value (bsc#1196564). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2022-1258,SUSE-OpenStack-Cloud-9-2022-1258,SUSE-OpenStack-Cloud-Crowbar-9-2022-1258,SUSE-SLE-SAP-12-SP4-2022-1258,SUSE-SLE-SERVER-12-SP4-LTSS-2022-1258 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20221258-1/ Link for SUSE-SU-2022:1258-1 https://lists.suse.com/pipermail/sle-security-updates/2022-April/010748.html E-Mail link for SUSE-SU-2022:1258-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1183735 SUSE Bug 1183735 https://bugzilla.suse.com/1189492 SUSE Bug 1189492 https://bugzilla.suse.com/1196564 SUSE Bug 1196564 https://www.suse.com/security/cve/CVE-2021-3621/ SUSE CVE CVE-2021-3621 page SUSE Linux Enterprise Server 12 SP4-LTSS SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE OpenStack Cloud 9 SUSE OpenStack Cloud Crowbar 9 libipa_hbac-devel-1.16.1-4.40.1 libipa_hbac0-1.16.1-4.40.1 libnfsidmap-sss-1.16.1-4.40.1 libsss_certmap-devel-1.16.1-4.40.1 libsss_certmap0-1.16.1-4.40.1 libsss_idmap-devel-1.16.1-4.40.1 libsss_idmap0-1.16.1-4.40.1 libsss_nss_idmap-devel-1.16.1-4.40.1 libsss_nss_idmap0-1.16.1-4.40.1 libsss_simpleifp-devel-1.16.1-4.40.1 libsss_simpleifp0-1.16.1-4.40.1 python-ipa_hbac-1.16.1-4.40.1 python-sss-murmur-1.16.1-4.40.1 python-sss_nss_idmap-1.16.1-4.40.1 python-sssd-config-1.16.1-4.40.1 sssd-1.16.1-4.40.1 sssd-32bit-1.16.1-4.40.1 sssd-64bit-1.16.1-4.40.1 sssd-ad-1.16.1-4.40.1 sssd-dbus-1.16.1-4.40.1 sssd-ipa-1.16.1-4.40.1 sssd-krb5-1.16.1-4.40.1 sssd-krb5-common-1.16.1-4.40.1 sssd-ldap-1.16.1-4.40.1 sssd-proxy-1.16.1-4.40.1 sssd-tools-1.16.1-4.40.1 libipa_hbac0-1.16.1-4.40.1 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS libsss_certmap0-1.16.1-4.40.1 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS libsss_idmap-devel-1.16.1-4.40.1 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS libsss_idmap0-1.16.1-4.40.1 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS libsss_nss_idmap-devel-1.16.1-4.40.1 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS libsss_nss_idmap0-1.16.1-4.40.1 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS libsss_simpleifp0-1.16.1-4.40.1 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS python-sssd-config-1.16.1-4.40.1 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS sssd-1.16.1-4.40.1 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS sssd-32bit-1.16.1-4.40.1 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS sssd-ad-1.16.1-4.40.1 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS sssd-dbus-1.16.1-4.40.1 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS sssd-ipa-1.16.1-4.40.1 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS sssd-krb5-1.16.1-4.40.1 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS sssd-krb5-common-1.16.1-4.40.1 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS sssd-ldap-1.16.1-4.40.1 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS sssd-proxy-1.16.1-4.40.1 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS sssd-tools-1.16.1-4.40.1 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS libipa_hbac0-1.16.1-4.40.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 libsss_certmap0-1.16.1-4.40.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 libsss_idmap0-1.16.1-4.40.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 libsss_nss_idmap0-1.16.1-4.40.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 libsss_simpleifp0-1.16.1-4.40.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 python-sssd-config-1.16.1-4.40.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 sssd-1.16.1-4.40.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 sssd-32bit-1.16.1-4.40.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 sssd-ad-1.16.1-4.40.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 sssd-dbus-1.16.1-4.40.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 sssd-ipa-1.16.1-4.40.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 sssd-krb5-1.16.1-4.40.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 sssd-krb5-common-1.16.1-4.40.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 sssd-ldap-1.16.1-4.40.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 sssd-proxy-1.16.1-4.40.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 sssd-tools-1.16.1-4.40.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 libipa_hbac0-1.16.1-4.40.1 as a component of SUSE OpenStack Cloud 9 libsss_certmap0-1.16.1-4.40.1 as a component of SUSE OpenStack Cloud 9 libsss_idmap0-1.16.1-4.40.1 as a component of SUSE OpenStack Cloud 9 libsss_nss_idmap0-1.16.1-4.40.1 as a component of SUSE OpenStack Cloud 9 libsss_simpleifp0-1.16.1-4.40.1 as a component of SUSE OpenStack Cloud 9 python-sssd-config-1.16.1-4.40.1 as a component of SUSE OpenStack Cloud 9 sssd-1.16.1-4.40.1 as a component of SUSE OpenStack Cloud 9 sssd-32bit-1.16.1-4.40.1 as a component of SUSE OpenStack Cloud 9 sssd-ad-1.16.1-4.40.1 as a component of SUSE OpenStack Cloud 9 sssd-dbus-1.16.1-4.40.1 as a component of SUSE OpenStack Cloud 9 sssd-ipa-1.16.1-4.40.1 as a component of SUSE OpenStack Cloud 9 sssd-krb5-1.16.1-4.40.1 as a component of SUSE OpenStack Cloud 9 sssd-krb5-common-1.16.1-4.40.1 as a component of SUSE OpenStack Cloud 9 sssd-ldap-1.16.1-4.40.1 as a component of SUSE OpenStack Cloud 9 sssd-proxy-1.16.1-4.40.1 as a component of SUSE OpenStack Cloud 9 sssd-tools-1.16.1-4.40.1 as a component of SUSE OpenStack Cloud 9 libipa_hbac0-1.16.1-4.40.1 as a component of SUSE OpenStack Cloud Crowbar 9 libsss_certmap0-1.16.1-4.40.1 as a component of SUSE OpenStack Cloud Crowbar 9 libsss_idmap0-1.16.1-4.40.1 as a component of SUSE OpenStack Cloud Crowbar 9 libsss_nss_idmap0-1.16.1-4.40.1 as a component of SUSE OpenStack Cloud Crowbar 9 libsss_simpleifp0-1.16.1-4.40.1 as a component of SUSE OpenStack Cloud Crowbar 9 python-sssd-config-1.16.1-4.40.1 as a component of SUSE OpenStack Cloud Crowbar 9 sssd-1.16.1-4.40.1 as a component of SUSE OpenStack Cloud Crowbar 9 sssd-32bit-1.16.1-4.40.1 as a component of SUSE OpenStack Cloud Crowbar 9 sssd-ad-1.16.1-4.40.1 as a component of SUSE OpenStack Cloud Crowbar 9 sssd-dbus-1.16.1-4.40.1 as a component of SUSE OpenStack Cloud Crowbar 9 sssd-ipa-1.16.1-4.40.1 as a component of SUSE OpenStack Cloud Crowbar 9 sssd-krb5-1.16.1-4.40.1 as a component of SUSE OpenStack Cloud Crowbar 9 sssd-krb5-common-1.16.1-4.40.1 as a component of SUSE OpenStack Cloud Crowbar 9 sssd-ldap-1.16.1-4.40.1 as a component of SUSE OpenStack Cloud Crowbar 9 sssd-proxy-1.16.1-4.40.1 as a component of SUSE OpenStack Cloud Crowbar 9 sssd-tools-1.16.1-4.40.1 as a component of SUSE OpenStack Cloud Crowbar 9 A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cache-expire subcommands. This flaw allows an attacker to trick the root user into running a specially crafted sssctl command, such as via sudo, to gain root access. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. CVE-2021-3621 SUSE Linux Enterprise Server 12 SP4-LTSS:libipa_hbac0-1.16.1-4.40.1 SUSE Linux Enterprise Server 12 SP4-LTSS:libsss_certmap0-1.16.1-4.40.1 SUSE Linux Enterprise Server 12 SP4-LTSS:libsss_idmap-devel-1.16.1-4.40.1 SUSE Linux Enterprise Server 12 SP4-LTSS:libsss_idmap0-1.16.1-4.40.1 SUSE Linux Enterprise Server 12 SP4-LTSS:libsss_nss_idmap-devel-1.16.1-4.40.1 SUSE Linux Enterprise Server 12 SP4-LTSS:libsss_nss_idmap0-1.16.1-4.40.1 SUSE Linux Enterprise Server 12 SP4-LTSS:libsss_simpleifp0-1.16.1-4.40.1 SUSE Linux Enterprise Server 12 SP4-LTSS:python-sssd-config-1.16.1-4.40.1 SUSE Linux Enterprise Server 12 SP4-LTSS:sssd-1.16.1-4.40.1 SUSE Linux Enterprise Server 12 SP4-LTSS:sssd-32bit-1.16.1-4.40.1 SUSE Linux Enterprise Server 12 SP4-LTSS:sssd-ad-1.16.1-4.40.1 SUSE Linux Enterprise Server 12 SP4-LTSS:sssd-dbus-1.16.1-4.40.1 SUSE Linux Enterprise Server 12 SP4-LTSS:sssd-ipa-1.16.1-4.40.1 SUSE Linux Enterprise Server 12 SP4-LTSS:sssd-krb5-1.16.1-4.40.1 SUSE Linux Enterprise Server 12 SP4-LTSS:sssd-krb5-common-1.16.1-4.40.1 SUSE Linux Enterprise Server 12 SP4-LTSS:sssd-ldap-1.16.1-4.40.1 SUSE Linux Enterprise Server 12 SP4-LTSS:sssd-proxy-1.16.1-4.40.1 SUSE Linux Enterprise Server 12 SP4-LTSS:sssd-tools-1.16.1-4.40.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libipa_hbac0-1.16.1-4.40.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libsss_certmap0-1.16.1-4.40.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libsss_idmap0-1.16.1-4.40.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libsss_nss_idmap0-1.16.1-4.40.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libsss_simpleifp0-1.16.1-4.40.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:python-sssd-config-1.16.1-4.40.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:sssd-1.16.1-4.40.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:sssd-32bit-1.16.1-4.40.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:sssd-ad-1.16.1-4.40.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:sssd-dbus-1.16.1-4.40.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:sssd-ipa-1.16.1-4.40.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:sssd-krb5-1.16.1-4.40.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:sssd-krb5-common-1.16.1-4.40.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:sssd-ldap-1.16.1-4.40.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:sssd-proxy-1.16.1-4.40.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:sssd-tools-1.16.1-4.40.1 SUSE OpenStack Cloud 9:libipa_hbac0-1.16.1-4.40.1 SUSE OpenStack Cloud 9:libsss_certmap0-1.16.1-4.40.1 SUSE OpenStack Cloud 9:libsss_idmap0-1.16.1-4.40.1 SUSE OpenStack Cloud 9:libsss_nss_idmap0-1.16.1-4.40.1 SUSE OpenStack Cloud 9:libsss_simpleifp0-1.16.1-4.40.1 SUSE OpenStack Cloud 9:python-sssd-config-1.16.1-4.40.1 SUSE OpenStack Cloud 9:sssd-1.16.1-4.40.1 SUSE OpenStack Cloud 9:sssd-32bit-1.16.1-4.40.1 SUSE OpenStack Cloud 9:sssd-ad-1.16.1-4.40.1 SUSE OpenStack Cloud 9:sssd-dbus-1.16.1-4.40.1 SUSE OpenStack Cloud 9:sssd-ipa-1.16.1-4.40.1 SUSE OpenStack Cloud 9:sssd-krb5-1.16.1-4.40.1 SUSE OpenStack Cloud 9:sssd-krb5-common-1.16.1-4.40.1 SUSE OpenStack Cloud 9:sssd-ldap-1.16.1-4.40.1 SUSE OpenStack Cloud 9:sssd-proxy-1.16.1-4.40.1 SUSE OpenStack Cloud 9:sssd-tools-1.16.1-4.40.1 SUSE OpenStack Cloud Crowbar 9:libipa_hbac0-1.16.1-4.40.1 SUSE OpenStack Cloud Crowbar 9:libsss_certmap0-1.16.1-4.40.1 SUSE OpenStack Cloud Crowbar 9:libsss_idmap0-1.16.1-4.40.1 SUSE OpenStack Cloud Crowbar 9:libsss_nss_idmap0-1.16.1-4.40.1 SUSE OpenStack Cloud Crowbar 9:libsss_simpleifp0-1.16.1-4.40.1 SUSE OpenStack Cloud Crowbar 9:python-sssd-config-1.16.1-4.40.1 SUSE OpenStack Cloud Crowbar 9:sssd-1.16.1-4.40.1 SUSE OpenStack Cloud Crowbar 9:sssd-32bit-1.16.1-4.40.1 SUSE OpenStack Cloud Crowbar 9:sssd-ad-1.16.1-4.40.1 SUSE OpenStack Cloud Crowbar 9:sssd-dbus-1.16.1-4.40.1 SUSE OpenStack Cloud Crowbar 9:sssd-ipa-1.16.1-4.40.1 SUSE OpenStack Cloud Crowbar 9:sssd-krb5-1.16.1-4.40.1 SUSE OpenStack Cloud Crowbar 9:sssd-krb5-common-1.16.1-4.40.1 SUSE OpenStack Cloud Crowbar 9:sssd-ldap-1.16.1-4.40.1 SUSE OpenStack Cloud Crowbar 9:sssd-proxy-1.16.1-4.40.1 SUSE OpenStack Cloud Crowbar 9:sssd-tools-1.16.1-4.40.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20221258-1/ https://www.suse.com/security/cve/CVE-2021-3621.html CVE-2021-3621 https://bugzilla.suse.com/1189492 SUSE Bug 1189492