Security update for sssd SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:2763-1 Final 1 1 2022-08-10T12:30:21Z current 2022-08-10T12:30:21Z 2022-08-10T12:30:21Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for sssd This update for sssd fixes the following issues: - CVE-2021-3621: Fixed shell command injection in sssctl via the logs-fetch and cache-expire subcommand (bsc#1189492). - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte (bsc#1190775) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common but baselibs.conf was not updated accordingly (bsc#1182058, bsc#1196166) - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2022-2763,SUSE-SLE-Module-Basesystem-15-SP4-2022-2763,openSUSE-SLE-15.4-2022-2763 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20222763-1/ Link for SUSE-SU-2022:2763-1 https://lists.suse.com/pipermail/sle-security-updates/2022-August/011887.html E-Mail link for SUSE-SU-2022:2763-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1182058 SUSE Bug 1182058 https://bugzilla.suse.com/1189492 SUSE Bug 1189492 https://bugzilla.suse.com/1190775 SUSE Bug 1190775 https://bugzilla.suse.com/1195552 SUSE Bug 1195552 https://bugzilla.suse.com/1196166 SUSE Bug 1196166 https://www.suse.com/security/cve/CVE-2021-3621/ SUSE CVE CVE-2021-3621 page SUSE Linux Enterprise Module for Basesystem 15 SP4 openSUSE Leap 15.4 libipa_hbac-devel-2.5.2-150400.4.5.14 libipa_hbac0-2.5.2-150400.4.5.14 libnfsidmap-sss-2.5.2-150400.4.5.14 libsss_certmap-devel-2.5.2-150400.4.5.14 libsss_certmap0-2.5.2-150400.4.5.14 libsss_idmap-devel-2.5.2-150400.4.5.14 libsss_idmap0-2.5.2-150400.4.5.14 libsss_nss_idmap-devel-2.5.2-150400.4.5.14 libsss_nss_idmap0-2.5.2-150400.4.5.14 libsss_simpleifp-devel-2.5.2-150400.4.5.14 libsss_simpleifp0-2.5.2-150400.4.5.14 python3-ipa_hbac-2.5.2-150400.4.5.14 python3-sss-murmur-2.5.2-150400.4.5.14 python3-sss_nss_idmap-2.5.2-150400.4.5.14 python3-sssd-config-2.5.2-150400.4.5.14 sssd-2.5.2-150400.4.5.14 sssd-ad-2.5.2-150400.4.5.14 sssd-common-2.5.2-150400.4.5.14 sssd-common-32bit-2.5.2-150400.4.5.14 sssd-common-64bit-2.5.2-150400.4.5.14 sssd-dbus-2.5.2-150400.4.5.14 sssd-ipa-2.5.2-150400.4.5.14 sssd-kcm-2.5.2-150400.4.5.14 sssd-krb5-2.5.2-150400.4.5.14 sssd-krb5-common-2.5.2-150400.4.5.14 sssd-ldap-2.5.2-150400.4.5.14 sssd-proxy-2.5.2-150400.4.5.14 sssd-tools-2.5.2-150400.4.5.14 sssd-winbind-idmap-2.5.2-150400.4.5.14 libipa_hbac-devel-2.5.2-150400.4.5.14 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP4 libipa_hbac0-2.5.2-150400.4.5.14 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP4 libsss_certmap-devel-2.5.2-150400.4.5.14 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP4 libsss_certmap0-2.5.2-150400.4.5.14 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP4 libsss_idmap-devel-2.5.2-150400.4.5.14 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP4 libsss_idmap0-2.5.2-150400.4.5.14 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP4 libsss_nss_idmap-devel-2.5.2-150400.4.5.14 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP4 libsss_nss_idmap0-2.5.2-150400.4.5.14 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP4 libsss_simpleifp-devel-2.5.2-150400.4.5.14 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP4 libsss_simpleifp0-2.5.2-150400.4.5.14 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP4 python3-sssd-config-2.5.2-150400.4.5.14 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP4 sssd-2.5.2-150400.4.5.14 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP4 sssd-ad-2.5.2-150400.4.5.14 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP4 sssd-common-2.5.2-150400.4.5.14 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP4 sssd-dbus-2.5.2-150400.4.5.14 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP4 sssd-ipa-2.5.2-150400.4.5.14 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP4 sssd-kcm-2.5.2-150400.4.5.14 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP4 sssd-krb5-2.5.2-150400.4.5.14 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP4 sssd-krb5-common-2.5.2-150400.4.5.14 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP4 sssd-ldap-2.5.2-150400.4.5.14 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP4 sssd-proxy-2.5.2-150400.4.5.14 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP4 sssd-tools-2.5.2-150400.4.5.14 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP4 sssd-winbind-idmap-2.5.2-150400.4.5.14 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP4 libipa_hbac-devel-2.5.2-150400.4.5.14 as a component of openSUSE Leap 15.4 libipa_hbac0-2.5.2-150400.4.5.14 as a component of openSUSE Leap 15.4 libnfsidmap-sss-2.5.2-150400.4.5.14 as a component of openSUSE Leap 15.4 libsss_certmap-devel-2.5.2-150400.4.5.14 as a component of openSUSE Leap 15.4 libsss_certmap0-2.5.2-150400.4.5.14 as a component of openSUSE Leap 15.4 libsss_idmap-devel-2.5.2-150400.4.5.14 as a component of openSUSE Leap 15.4 libsss_idmap0-2.5.2-150400.4.5.14 as a component of openSUSE Leap 15.4 libsss_nss_idmap-devel-2.5.2-150400.4.5.14 as a component of openSUSE Leap 15.4 libsss_nss_idmap0-2.5.2-150400.4.5.14 as a component of openSUSE Leap 15.4 libsss_simpleifp-devel-2.5.2-150400.4.5.14 as a component of openSUSE Leap 15.4 libsss_simpleifp0-2.5.2-150400.4.5.14 as a component of openSUSE Leap 15.4 python3-ipa_hbac-2.5.2-150400.4.5.14 as a component of openSUSE Leap 15.4 python3-sss-murmur-2.5.2-150400.4.5.14 as a component of openSUSE Leap 15.4 python3-sss_nss_idmap-2.5.2-150400.4.5.14 as a component of openSUSE Leap 15.4 python3-sssd-config-2.5.2-150400.4.5.14 as a component of openSUSE Leap 15.4 sssd-2.5.2-150400.4.5.14 as a component of openSUSE Leap 15.4 sssd-ad-2.5.2-150400.4.5.14 as a component of openSUSE Leap 15.4 sssd-common-2.5.2-150400.4.5.14 as a component of openSUSE Leap 15.4 sssd-dbus-2.5.2-150400.4.5.14 as a component of openSUSE Leap 15.4 sssd-ipa-2.5.2-150400.4.5.14 as a component of openSUSE Leap 15.4 sssd-kcm-2.5.2-150400.4.5.14 as a component of openSUSE Leap 15.4 sssd-krb5-2.5.2-150400.4.5.14 as a component of openSUSE Leap 15.4 sssd-krb5-common-2.5.2-150400.4.5.14 as a component of openSUSE Leap 15.4 sssd-ldap-2.5.2-150400.4.5.14 as a component of openSUSE Leap 15.4 sssd-proxy-2.5.2-150400.4.5.14 as a component of openSUSE Leap 15.4 sssd-tools-2.5.2-150400.4.5.14 as a component of openSUSE Leap 15.4 sssd-winbind-idmap-2.5.2-150400.4.5.14 as a component of openSUSE Leap 15.4 A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cache-expire subcommands. This flaw allows an attacker to trick the root user into running a specially crafted sssctl command, such as via sudo, to gain root access. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. CVE-2021-3621 SUSE Linux Enterprise Module for Basesystem 15 SP4:libipa_hbac-devel-2.5.2-150400.4.5.14 SUSE Linux Enterprise Module for Basesystem 15 SP4:libipa_hbac0-2.5.2-150400.4.5.14 SUSE Linux Enterprise Module for Basesystem 15 SP4:libsss_certmap-devel-2.5.2-150400.4.5.14 SUSE Linux Enterprise Module for Basesystem 15 SP4:libsss_certmap0-2.5.2-150400.4.5.14 SUSE Linux Enterprise Module for Basesystem 15 SP4:libsss_idmap-devel-2.5.2-150400.4.5.14 SUSE Linux Enterprise Module for Basesystem 15 SP4:libsss_idmap0-2.5.2-150400.4.5.14 SUSE Linux Enterprise Module for Basesystem 15 SP4:libsss_nss_idmap-devel-2.5.2-150400.4.5.14 SUSE Linux Enterprise Module for Basesystem 15 SP4:libsss_nss_idmap0-2.5.2-150400.4.5.14 SUSE Linux Enterprise Module for Basesystem 15 SP4:libsss_simpleifp-devel-2.5.2-150400.4.5.14 SUSE Linux Enterprise Module for Basesystem 15 SP4:libsss_simpleifp0-2.5.2-150400.4.5.14 SUSE Linux Enterprise Module for Basesystem 15 SP4:python3-sssd-config-2.5.2-150400.4.5.14 SUSE Linux Enterprise Module for Basesystem 15 SP4:sssd-2.5.2-150400.4.5.14 SUSE Linux Enterprise Module for Basesystem 15 SP4:sssd-ad-2.5.2-150400.4.5.14 SUSE Linux Enterprise Module for Basesystem 15 SP4:sssd-common-2.5.2-150400.4.5.14 SUSE Linux Enterprise Module for Basesystem 15 SP4:sssd-dbus-2.5.2-150400.4.5.14 SUSE Linux Enterprise Module for Basesystem 15 SP4:sssd-ipa-2.5.2-150400.4.5.14 SUSE Linux Enterprise Module for Basesystem 15 SP4:sssd-kcm-2.5.2-150400.4.5.14 SUSE Linux Enterprise Module for Basesystem 15 SP4:sssd-krb5-2.5.2-150400.4.5.14 SUSE Linux Enterprise Module for Basesystem 15 SP4:sssd-krb5-common-2.5.2-150400.4.5.14 SUSE Linux Enterprise Module for Basesystem 15 SP4:sssd-ldap-2.5.2-150400.4.5.14 SUSE Linux Enterprise Module for Basesystem 15 SP4:sssd-proxy-2.5.2-150400.4.5.14 SUSE Linux Enterprise Module for Basesystem 15 SP4:sssd-tools-2.5.2-150400.4.5.14 SUSE Linux Enterprise Module for Basesystem 15 SP4:sssd-winbind-idmap-2.5.2-150400.4.5.14 openSUSE Leap 15.4:libipa_hbac-devel-2.5.2-150400.4.5.14 openSUSE Leap 15.4:libipa_hbac0-2.5.2-150400.4.5.14 openSUSE Leap 15.4:libnfsidmap-sss-2.5.2-150400.4.5.14 openSUSE Leap 15.4:libsss_certmap-devel-2.5.2-150400.4.5.14 openSUSE Leap 15.4:libsss_certmap0-2.5.2-150400.4.5.14 openSUSE Leap 15.4:libsss_idmap-devel-2.5.2-150400.4.5.14 openSUSE Leap 15.4:libsss_idmap0-2.5.2-150400.4.5.14 openSUSE Leap 15.4:libsss_nss_idmap-devel-2.5.2-150400.4.5.14 openSUSE Leap 15.4:libsss_nss_idmap0-2.5.2-150400.4.5.14 openSUSE Leap 15.4:libsss_simpleifp-devel-2.5.2-150400.4.5.14 openSUSE Leap 15.4:libsss_simpleifp0-2.5.2-150400.4.5.14 openSUSE Leap 15.4:python3-ipa_hbac-2.5.2-150400.4.5.14 openSUSE Leap 15.4:python3-sss-murmur-2.5.2-150400.4.5.14 openSUSE Leap 15.4:python3-sss_nss_idmap-2.5.2-150400.4.5.14 openSUSE Leap 15.4:python3-sssd-config-2.5.2-150400.4.5.14 openSUSE Leap 15.4:sssd-2.5.2-150400.4.5.14 openSUSE Leap 15.4:sssd-ad-2.5.2-150400.4.5.14 openSUSE Leap 15.4:sssd-common-2.5.2-150400.4.5.14 openSUSE Leap 15.4:sssd-dbus-2.5.2-150400.4.5.14 openSUSE Leap 15.4:sssd-ipa-2.5.2-150400.4.5.14 openSUSE Leap 15.4:sssd-kcm-2.5.2-150400.4.5.14 openSUSE Leap 15.4:sssd-krb5-2.5.2-150400.4.5.14 openSUSE Leap 15.4:sssd-krb5-common-2.5.2-150400.4.5.14 openSUSE Leap 15.4:sssd-ldap-2.5.2-150400.4.5.14 openSUSE Leap 15.4:sssd-proxy-2.5.2-150400.4.5.14 openSUSE Leap 15.4:sssd-tools-2.5.2-150400.4.5.14 openSUSE Leap 15.4:sssd-winbind-idmap-2.5.2-150400.4.5.14 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222763-1/ https://www.suse.com/security/cve/CVE-2021-3621.html CVE-2021-3621 https://bugzilla.suse.com/1189492 SUSE Bug 1189492