Security update for sssd SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2019:1589-1 Final 1 1 2019-06-19T12:19:50Z current 2019-06-19T12:19:50Z 2019-06-19T12:19:50Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for sssd This update for sssd fixes the following issues: Security issue fixed: - CVE-2018-16838: Fixed an authentication bypass related to the Group Policy Objects implementation (bsc#1124194). Non-security issues fixed: - Allow defaults sudoRole without sudoUser attribute (bsc#1135247) - Missing GPOs directory could have led to login problems (bsc#1132879) - Fix a crash by adding a netgroup counter to struct nss_enum_index (bsc#1132657) This update was imported from the SUSE:SLE-15:Update update project. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2019-1589 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/LTMPMQK3HWS2LUXEMT7VPOZ2KIKKAUAZ/#LTMPMQK3HWS2LUXEMT7VPOZ2KIKKAUAZ E-Mail link for openSUSE-SU-2019:1589-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1124194 SUSE Bug 1124194 https://bugzilla.suse.com/1132657 SUSE Bug 1132657 https://bugzilla.suse.com/1132879 SUSE Bug 1132879 https://bugzilla.suse.com/1135247 SUSE Bug 1135247 https://www.suse.com/security/cve/CVE-2018-16838/ SUSE CVE CVE-2018-16838 page openSUSE Leap 15.0 openSUSE Leap 15.1 libipa_hbac-devel-1.16.1-lp151.7.3.1 libipa_hbac0-1.16.1-lp151.7.3.1 libnfsidmap-sss-1.16.1-lp151.7.3.1 libsss_certmap-devel-1.16.1-lp151.7.3.1 libsss_certmap0-1.16.1-lp151.7.3.1 libsss_idmap-devel-1.16.1-lp151.7.3.1 libsss_idmap0-1.16.1-lp151.7.3.1 libsss_nss_idmap-devel-1.16.1-lp151.7.3.1 libsss_nss_idmap0-1.16.1-lp151.7.3.1 libsss_simpleifp-devel-1.16.1-lp151.7.3.1 libsss_simpleifp0-1.16.1-lp151.7.3.1 python3-ipa_hbac-1.16.1-lp151.7.3.1 python3-sss-murmur-1.16.1-lp151.7.3.1 python3-sss_nss_idmap-1.16.1-lp151.7.3.1 python3-sssd-config-1.16.1-lp151.7.3.1 sssd-1.16.1-lp151.7.3.1 sssd-32bit-1.16.1-lp151.7.3.1 sssd-ad-1.16.1-lp151.7.3.1 sssd-dbus-1.16.1-lp151.7.3.1 sssd-ipa-1.16.1-lp151.7.3.1 sssd-krb5-1.16.1-lp151.7.3.1 sssd-krb5-common-1.16.1-lp151.7.3.1 sssd-ldap-1.16.1-lp151.7.3.1 sssd-proxy-1.16.1-lp151.7.3.1 sssd-tools-1.16.1-lp151.7.3.1 sssd-wbclient-1.16.1-lp151.7.3.1 sssd-wbclient-devel-1.16.1-lp151.7.3.1 sssd-winbind-idmap-1.16.1-lp151.7.3.1 libipa_hbac-devel-1.16.1-lp151.7.3.1 as a component of openSUSE Leap 15.0 libipa_hbac0-1.16.1-lp151.7.3.1 as a component of openSUSE Leap 15.0 libnfsidmap-sss-1.16.1-lp151.7.3.1 as a component of openSUSE Leap 15.0 libsss_certmap-devel-1.16.1-lp151.7.3.1 as a component of openSUSE Leap 15.0 libsss_certmap0-1.16.1-lp151.7.3.1 as a component of openSUSE Leap 15.0 libsss_idmap-devel-1.16.1-lp151.7.3.1 as a component of openSUSE Leap 15.0 libsss_idmap0-1.16.1-lp151.7.3.1 as a component of openSUSE Leap 15.0 libsss_nss_idmap-devel-1.16.1-lp151.7.3.1 as a component of openSUSE Leap 15.0 libsss_nss_idmap0-1.16.1-lp151.7.3.1 as a component of openSUSE Leap 15.0 libsss_simpleifp-devel-1.16.1-lp151.7.3.1 as a component of openSUSE Leap 15.0 libsss_simpleifp0-1.16.1-lp151.7.3.1 as a component of openSUSE Leap 15.0 python3-ipa_hbac-1.16.1-lp151.7.3.1 as a component of openSUSE Leap 15.0 python3-sss-murmur-1.16.1-lp151.7.3.1 as a component of openSUSE Leap 15.0 python3-sss_nss_idmap-1.16.1-lp151.7.3.1 as a component of openSUSE Leap 15.0 python3-sssd-config-1.16.1-lp151.7.3.1 as a component of openSUSE Leap 15.0 sssd-1.16.1-lp151.7.3.1 as a component of openSUSE Leap 15.0 sssd-32bit-1.16.1-lp151.7.3.1 as a component of openSUSE Leap 15.0 sssd-ad-1.16.1-lp151.7.3.1 as a component of openSUSE Leap 15.0 sssd-dbus-1.16.1-lp151.7.3.1 as a component of openSUSE Leap 15.0 sssd-ipa-1.16.1-lp151.7.3.1 as a component of openSUSE Leap 15.0 sssd-krb5-1.16.1-lp151.7.3.1 as a component of openSUSE Leap 15.0 sssd-krb5-common-1.16.1-lp151.7.3.1 as a component of openSUSE Leap 15.0 sssd-ldap-1.16.1-lp151.7.3.1 as a component of openSUSE Leap 15.0 sssd-proxy-1.16.1-lp151.7.3.1 as a component of openSUSE Leap 15.0 sssd-tools-1.16.1-lp151.7.3.1 as a component of openSUSE Leap 15.0 sssd-wbclient-1.16.1-lp151.7.3.1 as a component of openSUSE Leap 15.0 sssd-wbclient-devel-1.16.1-lp151.7.3.1 as a component of openSUSE Leap 15.0 sssd-winbind-idmap-1.16.1-lp151.7.3.1 as a component of openSUSE Leap 15.0 libipa_hbac-devel-1.16.1-lp151.7.3.1 as a component of openSUSE Leap 15.1 libipa_hbac0-1.16.1-lp151.7.3.1 as a component of openSUSE Leap 15.1 libnfsidmap-sss-1.16.1-lp151.7.3.1 as a component of openSUSE Leap 15.1 libsss_certmap-devel-1.16.1-lp151.7.3.1 as a component of openSUSE Leap 15.1 libsss_certmap0-1.16.1-lp151.7.3.1 as a component of openSUSE Leap 15.1 libsss_idmap-devel-1.16.1-lp151.7.3.1 as a component of openSUSE Leap 15.1 libsss_idmap0-1.16.1-lp151.7.3.1 as a component of openSUSE Leap 15.1 libsss_nss_idmap-devel-1.16.1-lp151.7.3.1 as a component of openSUSE Leap 15.1 libsss_nss_idmap0-1.16.1-lp151.7.3.1 as a component of openSUSE Leap 15.1 libsss_simpleifp-devel-1.16.1-lp151.7.3.1 as a component of openSUSE Leap 15.1 libsss_simpleifp0-1.16.1-lp151.7.3.1 as a component of openSUSE Leap 15.1 python3-ipa_hbac-1.16.1-lp151.7.3.1 as a component of openSUSE Leap 15.1 python3-sss-murmur-1.16.1-lp151.7.3.1 as a component of openSUSE Leap 15.1 python3-sss_nss_idmap-1.16.1-lp151.7.3.1 as a component of openSUSE Leap 15.1 python3-sssd-config-1.16.1-lp151.7.3.1 as a component of openSUSE Leap 15.1 sssd-1.16.1-lp151.7.3.1 as a component of openSUSE Leap 15.1 sssd-32bit-1.16.1-lp151.7.3.1 as a component of openSUSE Leap 15.1 sssd-ad-1.16.1-lp151.7.3.1 as a component of openSUSE Leap 15.1 sssd-dbus-1.16.1-lp151.7.3.1 as a component of openSUSE Leap 15.1 sssd-ipa-1.16.1-lp151.7.3.1 as a component of openSUSE Leap 15.1 sssd-krb5-1.16.1-lp151.7.3.1 as a component of openSUSE Leap 15.1 sssd-krb5-common-1.16.1-lp151.7.3.1 as a component of openSUSE Leap 15.1 sssd-ldap-1.16.1-lp151.7.3.1 as a component of openSUSE Leap 15.1 sssd-proxy-1.16.1-lp151.7.3.1 as a component of openSUSE Leap 15.1 sssd-tools-1.16.1-lp151.7.3.1 as a component of openSUSE Leap 15.1 sssd-wbclient-1.16.1-lp151.7.3.1 as a component of openSUSE Leap 15.1 sssd-wbclient-devel-1.16.1-lp151.7.3.1 as a component of openSUSE Leap 15.1 sssd-winbind-idmap-1.16.1-lp151.7.3.1 as a component of openSUSE Leap 15.1 A flaw was found in sssd Group Policy Objects implementation. When the GPO is not readable by SSSD due to a too strict permission settings on the server side, SSSD will allow all authenticated users to login instead of denying access. CVE-2018-16838 openSUSE Leap 15.0:libipa_hbac-devel-1.16.1-lp151.7.3.1 openSUSE Leap 15.0:libipa_hbac0-1.16.1-lp151.7.3.1 openSUSE Leap 15.0:libnfsidmap-sss-1.16.1-lp151.7.3.1 openSUSE Leap 15.0:libsss_certmap-devel-1.16.1-lp151.7.3.1 openSUSE Leap 15.0:libsss_certmap0-1.16.1-lp151.7.3.1 openSUSE Leap 15.0:libsss_idmap-devel-1.16.1-lp151.7.3.1 openSUSE Leap 15.0:libsss_idmap0-1.16.1-lp151.7.3.1 openSUSE Leap 15.0:libsss_nss_idmap-devel-1.16.1-lp151.7.3.1 openSUSE Leap 15.0:libsss_nss_idmap0-1.16.1-lp151.7.3.1 openSUSE Leap 15.0:libsss_simpleifp-devel-1.16.1-lp151.7.3.1 openSUSE Leap 15.0:libsss_simpleifp0-1.16.1-lp151.7.3.1 openSUSE Leap 15.0:python3-ipa_hbac-1.16.1-lp151.7.3.1 openSUSE Leap 15.0:python3-sss-murmur-1.16.1-lp151.7.3.1 openSUSE Leap 15.0:python3-sss_nss_idmap-1.16.1-lp151.7.3.1 openSUSE Leap 15.0:python3-sssd-config-1.16.1-lp151.7.3.1 openSUSE Leap 15.0:sssd-1.16.1-lp151.7.3.1 openSUSE Leap 15.0:sssd-32bit-1.16.1-lp151.7.3.1 openSUSE Leap 15.0:sssd-ad-1.16.1-lp151.7.3.1 openSUSE Leap 15.0:sssd-dbus-1.16.1-lp151.7.3.1 openSUSE Leap 15.0:sssd-ipa-1.16.1-lp151.7.3.1 openSUSE Leap 15.0:sssd-krb5-1.16.1-lp151.7.3.1 openSUSE Leap 15.0:sssd-krb5-common-1.16.1-lp151.7.3.1 openSUSE Leap 15.0:sssd-ldap-1.16.1-lp151.7.3.1 openSUSE Leap 15.0:sssd-proxy-1.16.1-lp151.7.3.1 openSUSE Leap 15.0:sssd-tools-1.16.1-lp151.7.3.1 openSUSE Leap 15.0:sssd-wbclient-1.16.1-lp151.7.3.1 openSUSE Leap 15.0:sssd-wbclient-devel-1.16.1-lp151.7.3.1 openSUSE Leap 15.0:sssd-winbind-idmap-1.16.1-lp151.7.3.1 openSUSE Leap 15.1:libipa_hbac-devel-1.16.1-lp151.7.3.1 openSUSE Leap 15.1:libipa_hbac0-1.16.1-lp151.7.3.1 openSUSE Leap 15.1:libnfsidmap-sss-1.16.1-lp151.7.3.1 openSUSE Leap 15.1:libsss_certmap-devel-1.16.1-lp151.7.3.1 openSUSE Leap 15.1:libsss_certmap0-1.16.1-lp151.7.3.1 openSUSE Leap 15.1:libsss_idmap-devel-1.16.1-lp151.7.3.1 openSUSE Leap 15.1:libsss_idmap0-1.16.1-lp151.7.3.1 openSUSE Leap 15.1:libsss_nss_idmap-devel-1.16.1-lp151.7.3.1 openSUSE Leap 15.1:libsss_nss_idmap0-1.16.1-lp151.7.3.1 openSUSE Leap 15.1:libsss_simpleifp-devel-1.16.1-lp151.7.3.1 openSUSE Leap 15.1:libsss_simpleifp0-1.16.1-lp151.7.3.1 openSUSE Leap 15.1:python3-ipa_hbac-1.16.1-lp151.7.3.1 openSUSE Leap 15.1:python3-sss-murmur-1.16.1-lp151.7.3.1 openSUSE Leap 15.1:python3-sss_nss_idmap-1.16.1-lp151.7.3.1 openSUSE Leap 15.1:python3-sssd-config-1.16.1-lp151.7.3.1 openSUSE Leap 15.1:sssd-1.16.1-lp151.7.3.1 openSUSE Leap 15.1:sssd-32bit-1.16.1-lp151.7.3.1 openSUSE Leap 15.1:sssd-ad-1.16.1-lp151.7.3.1 openSUSE Leap 15.1:sssd-dbus-1.16.1-lp151.7.3.1 openSUSE Leap 15.1:sssd-ipa-1.16.1-lp151.7.3.1 openSUSE Leap 15.1:sssd-krb5-1.16.1-lp151.7.3.1 openSUSE Leap 15.1:sssd-krb5-common-1.16.1-lp151.7.3.1 openSUSE Leap 15.1:sssd-ldap-1.16.1-lp151.7.3.1 openSUSE Leap 15.1:sssd-proxy-1.16.1-lp151.7.3.1 openSUSE Leap 15.1:sssd-tools-1.16.1-lp151.7.3.1 openSUSE Leap 15.1:sssd-wbclient-1.16.1-lp151.7.3.1 openSUSE Leap 15.1:sssd-wbclient-devel-1.16.1-lp151.7.3.1 openSUSE Leap 15.1:sssd-winbind-idmap-1.16.1-lp151.7.3.1 moderate 5.5 AV:N/AC:L/Au:S/C:P/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/LTMPMQK3HWS2LUXEMT7VPOZ2KIKKAUAZ/#LTMPMQK3HWS2LUXEMT7VPOZ2KIKKAUAZ https://www.suse.com/security/cve/CVE-2018-16838.html CVE-2018-16838 https://bugzilla.suse.com/1124194 SUSE Bug 1124194