SUSE-SU-2025:4231-1

Опубликовано: 25 нояб. 2025

Источник: suse-cvrf

Описание

Security update for sssd

This update for sssd fixes the following issues:

CVE-2025-11561: Fixed privilege escalation on AD-joined Linux systems due to default Kerberos configuration disabling localauth an2ln plugin (bsc#1251827)

Other fixes:

Install file in krb5.conf.d to include sssd krb5 config snippets (bsc#1244325)

Список пакетов

SUSE Enterprise Storage 7.1

libipa_hbac-devel-1.16.1-150300.23.56.1

libipa_hbac0-1.16.1-150300.23.56.1

libsss_certmap-devel-1.16.1-150300.23.56.1

libsss_certmap0-1.16.1-150300.23.56.1

libsss_idmap-devel-1.16.1-150300.23.56.1

libsss_idmap0-1.16.1-150300.23.56.1

libsss_nss_idmap-devel-1.16.1-150300.23.56.1

libsss_nss_idmap0-1.16.1-150300.23.56.1

libsss_simpleifp-devel-1.16.1-150300.23.56.1

libsss_simpleifp0-1.16.1-150300.23.56.1

python3-sssd-config-1.16.1-150300.23.56.1

sssd-1.16.1-150300.23.56.1

sssd-ad-1.16.1-150300.23.56.1

sssd-common-1.16.1-150300.23.56.1

sssd-common-32bit-1.16.1-150300.23.56.1

sssd-dbus-1.16.1-150300.23.56.1

sssd-ipa-1.16.1-150300.23.56.1

sssd-krb5-1.16.1-150300.23.56.1

sssd-krb5-common-1.16.1-150300.23.56.1

sssd-ldap-1.16.1-150300.23.56.1

sssd-proxy-1.16.1-150300.23.56.1

sssd-tools-1.16.1-150300.23.56.1

sssd-winbind-idmap-1.16.1-150300.23.56.1

SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS

libipa_hbac-devel-1.16.1-150300.23.56.1

libipa_hbac0-1.16.1-150300.23.56.1

libsss_certmap-devel-1.16.1-150300.23.56.1

libsss_certmap0-1.16.1-150300.23.56.1

libsss_idmap-devel-1.16.1-150300.23.56.1

libsss_idmap0-1.16.1-150300.23.56.1

libsss_nss_idmap-devel-1.16.1-150300.23.56.1

libsss_nss_idmap0-1.16.1-150300.23.56.1

libsss_simpleifp-devel-1.16.1-150300.23.56.1

libsss_simpleifp0-1.16.1-150300.23.56.1

python3-sssd-config-1.16.1-150300.23.56.1

sssd-1.16.1-150300.23.56.1

sssd-ad-1.16.1-150300.23.56.1

sssd-common-1.16.1-150300.23.56.1

sssd-common-32bit-1.16.1-150300.23.56.1

sssd-dbus-1.16.1-150300.23.56.1

sssd-ipa-1.16.1-150300.23.56.1

sssd-krb5-1.16.1-150300.23.56.1

sssd-krb5-common-1.16.1-150300.23.56.1

sssd-ldap-1.16.1-150300.23.56.1

sssd-proxy-1.16.1-150300.23.56.1

sssd-tools-1.16.1-150300.23.56.1

sssd-winbind-idmap-1.16.1-150300.23.56.1

SUSE Linux Enterprise Micro 5.2

libsss_certmap0-1.16.1-150300.23.56.1

libsss_idmap0-1.16.1-150300.23.56.1

libsss_nss_idmap0-1.16.1-150300.23.56.1

sssd-1.16.1-150300.23.56.1

sssd-common-1.16.1-150300.23.56.1

sssd-krb5-common-1.16.1-150300.23.56.1

sssd-ldap-1.16.1-150300.23.56.1

SUSE Linux Enterprise Server 15 SP3-LTSS

libipa_hbac-devel-1.16.1-150300.23.56.1

libipa_hbac0-1.16.1-150300.23.56.1

libsss_certmap-devel-1.16.1-150300.23.56.1

libsss_certmap0-1.16.1-150300.23.56.1

libsss_idmap-devel-1.16.1-150300.23.56.1

libsss_idmap0-1.16.1-150300.23.56.1

libsss_nss_idmap-devel-1.16.1-150300.23.56.1

libsss_nss_idmap0-1.16.1-150300.23.56.1

libsss_simpleifp-devel-1.16.1-150300.23.56.1

libsss_simpleifp0-1.16.1-150300.23.56.1

python3-sssd-config-1.16.1-150300.23.56.1

sssd-1.16.1-150300.23.56.1

sssd-ad-1.16.1-150300.23.56.1

sssd-common-1.16.1-150300.23.56.1

sssd-common-32bit-1.16.1-150300.23.56.1

sssd-dbus-1.16.1-150300.23.56.1

sssd-ipa-1.16.1-150300.23.56.1

sssd-krb5-1.16.1-150300.23.56.1

sssd-krb5-common-1.16.1-150300.23.56.1

sssd-ldap-1.16.1-150300.23.56.1

sssd-proxy-1.16.1-150300.23.56.1

sssd-tools-1.16.1-150300.23.56.1

sssd-winbind-idmap-1.16.1-150300.23.56.1

SUSE Linux Enterprise Server for SAP Applications 15 SP3

libipa_hbac-devel-1.16.1-150300.23.56.1

libipa_hbac0-1.16.1-150300.23.56.1

libsss_certmap-devel-1.16.1-150300.23.56.1

libsss_certmap0-1.16.1-150300.23.56.1

libsss_idmap-devel-1.16.1-150300.23.56.1

libsss_idmap0-1.16.1-150300.23.56.1

libsss_nss_idmap-devel-1.16.1-150300.23.56.1

libsss_nss_idmap0-1.16.1-150300.23.56.1

libsss_simpleifp-devel-1.16.1-150300.23.56.1

libsss_simpleifp0-1.16.1-150300.23.56.1

python3-sssd-config-1.16.1-150300.23.56.1

sssd-1.16.1-150300.23.56.1

sssd-ad-1.16.1-150300.23.56.1

sssd-common-1.16.1-150300.23.56.1

sssd-common-32bit-1.16.1-150300.23.56.1

sssd-dbus-1.16.1-150300.23.56.1

sssd-ipa-1.16.1-150300.23.56.1

sssd-krb5-1.16.1-150300.23.56.1

sssd-krb5-common-1.16.1-150300.23.56.1

sssd-ldap-1.16.1-150300.23.56.1

sssd-proxy-1.16.1-150300.23.56.1

sssd-tools-1.16.1-150300.23.56.1

sssd-winbind-idmap-1.16.1-150300.23.56.1

Ссылки

https://www.suse.com/support/update/announcement/2025/suse-su-20254231-1/
Link for SUSE-SU-2025:4231-1
https://lists.suse.com/pipermail/sle-security-updates/2025-November/023359.html
E-Mail link for SUSE-SU-2025:4231-1
https://www.suse.com/support/security/rating/
SUSE Security Ratings
https://bugzilla.suse.com/1244325
SUSE Bug 1244325
https://bugzilla.suse.com/1251827
SUSE Bug 1251827
https://www.suse.com/security/cve/CVE-2025-11561/
SUSE CVE CVE-2025-11561 page

Описание

A flaw was found in the integration of Active Directory and the System Security Services Daemon (SSSD) on Linux systems. In default configurations, the Kerberos local authentication plugin (sssd_krb5_localauth_plugin) is enabled, but a fallback to the an2ln plugin is possible. This fallback allows an attacker with permission to modify certain AD attributes (such as userPrincipalName or samAccountName) to impersonate privileged users, potentially resulting in unauthorized access or privilege escalation on domain-joined Linux hosts.

Затронутые продукты

SUSE Enterprise Storage 7.1:libipa_hbac-devel-1.16.1-150300.23.56.1

SUSE Enterprise Storage 7.1:libipa_hbac0-1.16.1-150300.23.56.1

SUSE Enterprise Storage 7.1:libsss_certmap-devel-1.16.1-150300.23.56.1

SUSE Enterprise Storage 7.1:libsss_certmap0-1.16.1-150300.23.56.1

Ссылки

https://www.suse.com/security/cve/CVE-2025-11561.html
CVE-2025-11561
https://bugzilla.suse.com/1251827
SUSE Bug 1251827

SUSE-SU-2025:4231-1

Описание

Список пакетов

SUSE Enterprise Storage 7.1

SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS

SUSE Linux Enterprise Micro 5.2

SUSE Linux Enterprise Server 15 SP3-LTSS

SUSE Linux Enterprise Server for SAP Applications 15 SP3

Ссылки

Уязвимость: CVE-2025-11561

Описание

Затронутые продукты

Ссылки