Описание
Security update for sssd
This update for sssd fixes the following issue:
- CVE-2026-12610: cancelled or completed PAM request while the asynchronous child process is still running can lead to a use-after-free (bsc#1269807).
Список пакетов
openSUSE Leap 16.0
libipa_hbac-devel-2.10.2-160000.4.1
libipa_hbac0-2.10.2-160000.4.1
libnfsidmap-sss-2.10.2-160000.4.1
libsss_certmap-devel-2.10.2-160000.4.1
libsss_certmap0-2.10.2-160000.4.1
libsss_idmap-devel-2.10.2-160000.4.1
libsss_idmap0-2.10.2-160000.4.1
libsss_nss_idmap-devel-2.10.2-160000.4.1
libsss_nss_idmap0-2.10.2-160000.4.1
python3-ipa_hbac-2.10.2-160000.4.1
python3-sss-murmur-2.10.2-160000.4.1
python3-sss_nss_idmap-2.10.2-160000.4.1
python3-sssd-config-2.10.2-160000.4.1
sssd-2.10.2-160000.4.1
sssd-ad-2.10.2-160000.4.1
sssd-cifs-idmap-plugin-2.10.2-160000.4.1
sssd-dbus-2.10.2-160000.4.1
sssd-ipa-2.10.2-160000.4.1
sssd-kcm-2.10.2-160000.4.1
sssd-krb5-2.10.2-160000.4.1
sssd-krb5-common-2.10.2-160000.4.1
sssd-ldap-2.10.2-160000.4.1
sssd-proxy-2.10.2-160000.4.1
sssd-tools-2.10.2-160000.4.1
sssd-winbind-idmap-2.10.2-160000.4.1
Ссылки
- SUSE Security Ratings
- SUSE Bug 1269807
- SUSE CVE CVE-2026-12610 page
Описание
A flaw was found in sssd. When authenticating with a YubiKey, the SSSD PAM responder can crash due to a use-after-free vulnerability, where a memory pointer is incorrectly handled. A local attacker could exploit this flaw by manipulating smartcard or YubiKey contents, leading to a denial of service that disrupts authentication. This vulnerability also presents a potential for privilege escalation, although it is difficult to exploit.
Затронутые продукты
openSUSE Leap 16.0:libipa_hbac-devel-2.10.2-160000.4.1
openSUSE Leap 16.0:libipa_hbac0-2.10.2-160000.4.1
openSUSE Leap 16.0:libnfsidmap-sss-2.10.2-160000.4.1
openSUSE Leap 16.0:libsss_certmap-devel-2.10.2-160000.4.1
Ссылки
- CVE-2026-12610
- SUSE Bug 1269807