Security update for sssd SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2017:2942-1 Final 1 1 2017-11-07T01:02:00Z current 2017-11-07T01:02:00Z 2017-11-07T01:02:00Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for sssd This update for sssd provides the following fixes: Security issues fixed: - CVE-2017-12173: Fixed unsanitized input when searching in local cache database (bsc#1061832). Non security issues fixed: - Fixed a segfault issue in ldap_rfc_2307_fallback_to_local_users. (bsc#1055123) - Install /var/lib/sss/mc directory to correct sssd cache invalidation behaviour. (bsc#1039567) This update was imported from the SUSE:SLE-12-SP2:Update update project. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/opensuse-updates/2017-11/msg00016.html E-Mail link for openSUSE-SU-2017:2942-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings openSUSE Leap 42.2 openSUSE Leap 42.3 libipa_hbac-devel-1.13.4-9.1 libipa_hbac0-1.13.4-9.1 libsss_idmap-devel-1.13.4-9.1 libsss_idmap0-1.13.4-9.1 libsss_nss_idmap-devel-1.13.4-9.1 libsss_nss_idmap0-1.13.4-9.1 libsss_sudo-1.13.4-9.1 python-ipa_hbac-1.13.4-9.1 python-sss_nss_idmap-1.13.4-9.1 python-sssd-config-1.13.4-9.1 sssd-1.13.4-9.1 sssd-32bit-1.13.4-9.1 sssd-ad-1.13.4-9.1 sssd-ipa-1.13.4-9.1 sssd-krb5-1.13.4-9.1 sssd-krb5-common-1.13.4-9.1 sssd-ldap-1.13.4-9.1 sssd-proxy-1.13.4-9.1 sssd-tools-1.13.4-9.1 libipa_hbac-devel-1.13.4-9.1 as a component of openSUSE Leap 42.2 libipa_hbac0-1.13.4-9.1 as a component of openSUSE Leap 42.2 libsss_idmap-devel-1.13.4-9.1 as a component of openSUSE Leap 42.2 libsss_idmap0-1.13.4-9.1 as a component of openSUSE Leap 42.2 libsss_nss_idmap-devel-1.13.4-9.1 as a component of openSUSE Leap 42.2 libsss_nss_idmap0-1.13.4-9.1 as a component of openSUSE Leap 42.2 libsss_sudo-1.13.4-9.1 as a component of openSUSE Leap 42.2 python-ipa_hbac-1.13.4-9.1 as a component of openSUSE Leap 42.2 python-sss_nss_idmap-1.13.4-9.1 as a component of openSUSE Leap 42.2 python-sssd-config-1.13.4-9.1 as a component of openSUSE Leap 42.2 sssd-1.13.4-9.1 as a component of openSUSE Leap 42.2 sssd-32bit-1.13.4-9.1 as a component of openSUSE Leap 42.2 sssd-ad-1.13.4-9.1 as a component of openSUSE Leap 42.2 sssd-ipa-1.13.4-9.1 as a component of openSUSE Leap 42.2 sssd-krb5-1.13.4-9.1 as a component of openSUSE Leap 42.2 sssd-krb5-common-1.13.4-9.1 as a component of openSUSE Leap 42.2 sssd-ldap-1.13.4-9.1 as a component of openSUSE Leap 42.2 sssd-proxy-1.13.4-9.1 as a component of openSUSE Leap 42.2 sssd-tools-1.13.4-9.1 as a component of openSUSE Leap 42.2 libipa_hbac-devel-1.13.4-9.1 as a component of openSUSE Leap 42.3 libipa_hbac0-1.13.4-9.1 as a component of openSUSE Leap 42.3 libsss_idmap-devel-1.13.4-9.1 as a component of openSUSE Leap 42.3 libsss_idmap0-1.13.4-9.1 as a component of openSUSE Leap 42.3 libsss_nss_idmap-devel-1.13.4-9.1 as a component of openSUSE Leap 42.3 libsss_nss_idmap0-1.13.4-9.1 as a component of openSUSE Leap 42.3 libsss_sudo-1.13.4-9.1 as a component of openSUSE Leap 42.3 python-ipa_hbac-1.13.4-9.1 as a component of openSUSE Leap 42.3 python-sss_nss_idmap-1.13.4-9.1 as a component of openSUSE Leap 42.3 python-sssd-config-1.13.4-9.1 as a component of openSUSE Leap 42.3 sssd-1.13.4-9.1 as a component of openSUSE Leap 42.3 sssd-32bit-1.13.4-9.1 as a component of openSUSE Leap 42.3 sssd-ad-1.13.4-9.1 as a component of openSUSE Leap 42.3 sssd-ipa-1.13.4-9.1 as a component of openSUSE Leap 42.3 sssd-krb5-1.13.4-9.1 as a component of openSUSE Leap 42.3 sssd-krb5-common-1.13.4-9.1 as a component of openSUSE Leap 42.3 sssd-ldap-1.13.4-9.1 as a component of openSUSE Leap 42.3 sssd-proxy-1.13.4-9.1 as a component of openSUSE Leap 42.3 sssd-tools-1.13.4-9.1 as a component of openSUSE Leap 42.3 It was found that sssd's sysdb_search_user_by_upn_res() function before 1.16.0 did not sanitize requests when querying its local cache and was vulnerable to injection. In a centralized login environment, if a password hash was locally cached for a given user, an authenticated attacker could use this flaw to retrieve it. CVE-2017-12173 openSUSE Leap 42.2:libipa_hbac-devel-1.13.4-9.1 openSUSE Leap 42.2:libipa_hbac0-1.13.4-9.1 openSUSE Leap 42.2:libsss_idmap-devel-1.13.4-9.1 openSUSE Leap 42.2:libsss_idmap0-1.13.4-9.1 openSUSE Leap 42.2:libsss_nss_idmap-devel-1.13.4-9.1 openSUSE Leap 42.2:libsss_nss_idmap0-1.13.4-9.1 openSUSE Leap 42.2:libsss_sudo-1.13.4-9.1 openSUSE Leap 42.2:python-ipa_hbac-1.13.4-9.1 openSUSE Leap 42.2:python-sss_nss_idmap-1.13.4-9.1 openSUSE Leap 42.2:python-sssd-config-1.13.4-9.1 openSUSE Leap 42.2:sssd-1.13.4-9.1 openSUSE Leap 42.2:sssd-32bit-1.13.4-9.1 openSUSE Leap 42.2:sssd-ad-1.13.4-9.1 openSUSE Leap 42.2:sssd-ipa-1.13.4-9.1 openSUSE Leap 42.2:sssd-krb5-1.13.4-9.1 openSUSE Leap 42.2:sssd-krb5-common-1.13.4-9.1 openSUSE Leap 42.2:sssd-ldap-1.13.4-9.1 openSUSE Leap 42.2:sssd-proxy-1.13.4-9.1 openSUSE Leap 42.2:sssd-tools-1.13.4-9.1 openSUSE Leap 42.3:libipa_hbac-devel-1.13.4-9.1 openSUSE Leap 42.3:libipa_hbac0-1.13.4-9.1 openSUSE Leap 42.3:libsss_idmap-devel-1.13.4-9.1 openSUSE Leap 42.3:libsss_idmap0-1.13.4-9.1 openSUSE Leap 42.3:libsss_nss_idmap-devel-1.13.4-9.1 openSUSE Leap 42.3:libsss_nss_idmap0-1.13.4-9.1 openSUSE Leap 42.3:libsss_sudo-1.13.4-9.1 openSUSE Leap 42.3:python-ipa_hbac-1.13.4-9.1 openSUSE Leap 42.3:python-sss_nss_idmap-1.13.4-9.1 openSUSE Leap 42.3:python-sssd-config-1.13.4-9.1 openSUSE Leap 42.3:sssd-1.13.4-9.1 openSUSE Leap 42.3:sssd-32bit-1.13.4-9.1 openSUSE Leap 42.3:sssd-ad-1.13.4-9.1 openSUSE Leap 42.3:sssd-ipa-1.13.4-9.1 openSUSE Leap 42.3:sssd-krb5-1.13.4-9.1 openSUSE Leap 42.3:sssd-krb5-common-1.13.4-9.1 openSUSE Leap 42.3:sssd-ldap-1.13.4-9.1 openSUSE Leap 42.3:sssd-proxy-1.13.4-9.1 openSUSE Leap 42.3:sssd-tools-1.13.4-9.1 low 1.7 AV:L/AC:L/Au:S/C:P/I:N/A:N Please Install the update. https://lists.opensuse.org/opensuse-updates/2017-11/msg00016.html https://www.suse.com/security/cve/CVE-2017-12173.html CVE-2017-12173 https://bugzilla.suse.com/1061832 SUSE Bug 1061832