CVE-2017-7488 Information disclosure in authconfig

Medium 4.3 Published 16 May 2017 Updated 5 Aug 2024

An attacker can discover valid usernames by exploiting an information exposure vulnerability in authconfig when using SSSD for remote authentication.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2017-7488?

CVE-2017-7488 is a medium-severity vulnerability in authconfig, published on 16 May 2017. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Authconfig version 6.2.8 is vulnerable to an Information exposure while using SSSD to authenticate against remote server resulting in the leak of information about existing usernames.

Weakness: CWE-200

Which versions are affected by CVE-2017-7488?

It affects 1 product.

Linux distribution packages (12)

`authconfig` Red Hat:enterprise_linux:7::client	All versions	`0:6.2.8-30.el7`
`authconfig-debuginfo` Red Hat:enterprise_linux:7::client	All versions	`0:6.2.8-30.el7`
`authconfig-gtk` Red Hat:enterprise_linux:7::client	All versions	`0:6.2.8-30.el7`
`authconfig` Red Hat:enterprise_linux:7::computenode	All versions	`0:6.2.8-30.el7`
`authconfig-debuginfo` Red Hat:enterprise_linux:7::computenode	All versions	`0:6.2.8-30.el7`
`authconfig-gtk` Red Hat:enterprise_linux:7::computenode	All versions	`0:6.2.8-30.el7`
`authconfig` Red Hat:enterprise_linux:7::server	All versions	`0:6.2.8-30.el7`
`authconfig-debuginfo` Red Hat:enterprise_linux:7::server	All versions	`0:6.2.8-30.el7`
`authconfig-gtk` Red Hat:enterprise_linux:7::server	All versions	`0:6.2.8-30.el7`
`authconfig` Red Hat:enterprise_linux:7::workstation	All versions	`0:6.2.8-30.el7`
`authconfig-debuginfo` Red Hat:enterprise_linux:7::workstation	All versions	`0:6.2.8-30.el7`
`authconfig-gtk` Red Hat:enterprise_linux:7::workstation	All versions	`0:6.2.8-30.el7`

Products include Authconfig Project Authconfig.

How do I fix CVE-2017-7488?

Apply the vendor's patch.

Is CVE-2017-7488 being exploited?

There is no known exploitation of CVE-2017-7488 in the wild and no public exploit code.

Sources

Also known as GHSA-3f5g-f3vm-8xqf, RHSA-2017:2285.