ALBA-2021:2571 sssd bug fix and enhancement update
SSSD update fixes bugs including a security bypass where implicit deny policies failed to block logins.
- Exploited in the wild
- Not known
- Login needed
- Not stated
- Attackable
- Not stated
- Victim action needed
- Not stated
- Fix
- Available
What is ALBA-2021:2571?
ALBA-2021:2571 is a vulnerability in libsss_nss_idmap-devel, published on 29 Jun 2021.
Official description
The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to connect to multiple different account sources.
Bug Fix(es) and Enhancement(s):
Wrong default debug level of sssd tools (BZ#1942438)
IPA missing secondary IPA Posix groups in latest sssd 1.16.5-10.el7_9.7 (BZ#1945654)
SSSD not detecting subdomain from AD forest (AlmaLinux 8.3) (BZ#1945655)
No gpo found and ad_gpo_implicit_deny set to True still permits user login (BZ#1945656)
pam_sss_gss.so doesn't work with large kerberos tickets (BZ#1949170)
Which versions are affected by ALBA-2021:2571?
Linux distribution packages (1)
libsss_nss_idmap-devel AlmaLinux:8 | All versions | 2.4.0-9.el8_4.1 |
How do I fix ALBA-2021:2571?
Apply the vendor's patch.
Is ALBA-2021:2571 being exploited?
There is no known exploitation of ALBA-2021:2571 in the wild and no public exploit code.