RHSA-2018:3158 - Security Advisory

Topic

An update for sssd is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to connect to multiple different account sources.

The following packages have been upgraded to a later upstream version: sssd (1.16.2). (BZ#1558498)

Security Fix(es):

• sssd: information leak from the sssd-sudo responder (CVE-2018-10852)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

This issue was discovered by Jakub Hrozek (Red Hat).

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.6 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for IBM z Systems 7 s390x
• Red Hat Enterprise Linux for Power, big endian 7 ppc64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Enterprise Linux for Power, little endian 7 ppc64le
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x
• Red Hat Enterprise Linux for ARM 64 7 aarch64
• Red Hat Enterprise Linux for Power 9 7 ppc64le
• Red Hat Enterprise Linux for IBM System z (Structure A) 7 s390x
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 ppc64le

Fixes

• BZ - 1385665 - Incorrect error code returned from krb5_child (updated)
• BZ - 1416528 - sssd in cross realm trust configuration should be able to use AD KDCs from a client site defined in sssd.conf or a snippet
• BZ - 1459348 - extend sss-certmap man page regarding priority processing
• BZ - 1509691 - Document how to change the regular expression for SSSD so that group names with an @-sign can be parsed
• BZ - 1514061 - ID override GID from Default Trust View is not properly resolved in case domain resolution order is set
• BZ - 1516266 - Give a more detailed debug and system-log message if krb5_init_context() failed
• BZ - 1522928 - sssd doesn't allow user with expired password to login when PasswordgraceLimit set
• BZ - 1534749 - Requesting an AD user's private group and then the user itself returns an emty homedir
• BZ - 1537272 - SSH public key authentication keeps working after keys are removed from ID view
• BZ - 1537279 - Certificate is not removed from cache when it's removed from the override
• BZ - 1538555 - crash in nss_protocol_fill_netgrent. sssd_nss[19234]: segfault at 80 ip 000055612688c2a0 sp 00007ffddf9b9cd0 error 4 in sssd_nss[55612687e000+39000]
• BZ - 1546754 - The man page of sss_ssh_authorizedkeys can be enhanced to better explain how the keys are retrieved and how X.509 certificates can be used
• BZ - 1558498 - Rebase sssd to the latests upstream release of the 1.16 branch
• BZ - 1562025 - externalUser sudo attribute must be fully-qualified
• BZ - 1565774 - After updating to RHEL 7.5 failing to clear the sssd cache
• BZ - 1566782 - memory management issue in the sssd_nss_ex interface can cause the ns-slapd process on IPA server to crash
• BZ - 1571526 - SSSD with ID provider 'ad' should give a warning in case the ldap schema is manually changed to something different than 'ad'.
• BZ - 1577335 - /usr/libexec/sssd/sssd_autofs SIGABRT crash daily
• BZ - 1578291 - Samba can not register sss idmap module because it's using an outdated SMB_IDMAP_INTERFACE_VERSION
• BZ - 1583251 - home dir disappear in sssd cache on the IPA master for AD users
• BZ - 1583725 - SSSD AD uses LDAP filter to detect POSIX attributes stored in AD GC also for regular AD DC queries
• BZ - 1588810 - CVE-2018-10852 sssd: information leak from the sssd-sudo responder
• BZ - 1600822 - SSSD bails out saving desktop profiles in case an invalid profile is found
• BZ - 1602781 - Offline logins and/or id_provider=local logins fail after upgrade to 7.6
• BZ - 1607313 - When sssd is running as non-root user, the sudo pipe is created as sssd:sssd but then the private pipe ownership fails
• BZ - 1610667 - sssd_ssh leaks file descriptors when more than one certificate is converted into an SSH key

CVEs

• CVE-2018-10852

References

• https://access.redhat.com/security/updates/classification/#low
• https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.6_release_notes/index