Описание
The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD has too wide permissions, which means that anyone who can send a message using the same raw protocol that sudo and SSSD use can read the sudo rules available for any user. This affects versions of SSSD before 1.16.3.
The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD utilizes too broad of a set of permissions. Any user who can send a message using the same raw protocol that sudo and SSSD use can read the sudo rules available for any user.
Отчет
Red Hat Satellite since version 6.4 uses sssd from the Red Hat Enterprise Linux repositories, where this vulnerability is fixed.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 5 | sssd | Will not fix | ||
| Red Hat Enterprise Linux 6 | sssd | Will not fix | ||
| Red Hat Enterprise Linux 8 | sssd | Not affected | ||
| Red Hat Satellite 6 | sssd | Fix deferred | ||
| Red Hat Enterprise Linux 7 | sssd | Fixed | RHSA-2018:3158 | 30.10.2018 |
Показывать по
Дополнительная информация
Статус:
EPSS
3.8 Low
CVSS3
Связанные уязвимости
The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD has too wide permissions, which means that anyone who can send a message using the same raw protocol that sudo and SSSD use can read the sudo rules available for any user. This affects versions of SSSD before 1.16.3.
The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD has too wide permissions, which means that anyone who can send a message using the same raw protocol that sudo and SSSD use can read the sudo rules available for any user. This affects versions of SSSD before 1.16.3.
The UNIX pipe which sudo uses to contact SSSD and read the available s ...
EPSS
3.8 Low
CVSS3