Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2026:21748-1

Опубликовано: 03 сент. 2026
Источник: suse-cvrf

Описание

Security update for sssd

This update for sssd fixes the following issues:

Security issues fixed:

  • CVE-2026-68742: insufficient validation in the NSS responder can lead to an out-of-bounds read and a process crash when a crafted GETHOSTBYADDR request is sent to the NSS responder socket (bsc#1273922).
  • CVE-2026-68743: insufficient validation in the PAM responder can lead to an out-of-bounds read and a process crash when a crafted protocol v1 request is processed (bsc#1273925).
  • CVE-2026-68744: improper memory management in the NSS responder can lead to uninitialized heap memory disclosure from the sssd_nss process (bsc#1273924).

Other updates and bugfixes:

  • Add systemd-tmpfiles configuration file to populate /var/lib/sss with the correct permissions on transactional servers (bsc#1274748).

Список пакетов

openSUSE Leap 16.0
libipa_hbac-devel-2.10.2-160000.5.1
libipa_hbac0-2.10.2-160000.5.1
libnfsidmap-sss-2.10.2-160000.5.1
libsss_certmap-devel-2.10.2-160000.5.1
libsss_certmap0-2.10.2-160000.5.1
libsss_idmap-devel-2.10.2-160000.5.1
libsss_idmap0-2.10.2-160000.5.1
libsss_nss_idmap-devel-2.10.2-160000.5.1
libsss_nss_idmap0-2.10.2-160000.5.1
python3-ipa_hbac-2.10.2-160000.5.1
python3-sss-murmur-2.10.2-160000.5.1
python3-sss_nss_idmap-2.10.2-160000.5.1
python3-sssd-config-2.10.2-160000.5.1
sssd-2.10.2-160000.5.1
sssd-ad-2.10.2-160000.5.1
sssd-cifs-idmap-plugin-2.10.2-160000.5.1
sssd-dbus-2.10.2-160000.5.1
sssd-ipa-2.10.2-160000.5.1
sssd-kcm-2.10.2-160000.5.1
sssd-krb5-2.10.2-160000.5.1
sssd-krb5-common-2.10.2-160000.5.1
sssd-ldap-2.10.2-160000.5.1
sssd-proxy-2.10.2-160000.5.1
sssd-tools-2.10.2-160000.5.1
sssd-winbind-idmap-2.10.2-160000.5.1

Ссылки

Описание

A flaw was found in SSSD. The sss_nss_protocol_parse_addr() function in the NSS responder does not validate the addrlen field against the remaining packet body size. A local attacker can exploit this via a crafted GETHOSTBYADDR request to the NSS responder socket, causing an out-of-bounds read and process crash, resulting in a denial of service.

Затронутые продукты
openSUSE Leap 16.0:libipa_hbac-devel-2.10.2-160000.5.1
openSUSE Leap 16.0:libipa_hbac0-2.10.2-160000.5.1
openSUSE Leap 16.0:libnfsidmap-sss-2.10.2-160000.5.1
openSUSE Leap 16.0:libsss_certmap-devel-2.10.2-160000.5.1
Ссылки

Описание

A flaw was found in SSSD. The extract_authtok_v1() function in the PAM responder does not validate the auth_token_length field against the remaining buffer size before processing. A local attacker can exploit this via a crafted protocol v1 request to the PAM responder socket, causing an out-of-bounds read and process crash, resulting in a denial of service.

Затронутые продукты
openSUSE Leap 16.0:libipa_hbac-devel-2.10.2-160000.5.1
openSUSE Leap 16.0:libipa_hbac0-2.10.2-160000.5.1
openSUSE Leap 16.0:libnfsidmap-sss-2.10.2-160000.5.1
openSUSE Leap 16.0:libsss_certmap-devel-2.10.2-160000.5.1
Ссылки

Описание

A flaw was found in SSSD. The sss_nss_protocol_fill_initgr() function in the NSS responder pre-allocates reply space for all group entries but does not shrink the packet when groups are skipped, causing uninitialized heap bytes to be transmitted to the client. A local attacker can exploit this to disclose cached directory data and heap layout information from the sssd_nss process.

Затронутые продукты
openSUSE Leap 16.0:libipa_hbac-devel-2.10.2-160000.5.1
openSUSE Leap 16.0:libipa_hbac0-2.10.2-160000.5.1
openSUSE Leap 16.0:libnfsidmap-sss-2.10.2-160000.5.1
openSUSE Leap 16.0:libsss_certmap-devel-2.10.2-160000.5.1
Ссылки
Уязвимость openSUSE-SU-2026:21748-1