Red Hat Security AdvisoryRHSA-2018:1877
sssd and ding-libs security and bug fix update
Released 2018-06-19 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Desktop (v. 6) ding-libs-0.4.0-13.el6, libbasicobjects-0.1.1-13.el6, libcollection-0.6.2-13.el6 +20
- Red Hat Enterprise Linux Desktop Optional (v. 6) libbasicobjects-devel-0.1.1-13.el6, libcollection-devel-0.6.2-13.el6, libdhash-devel-0.4.3-13.el6 +12
- Red Hat Enterprise Linux HPC Node (v. 6) ding-libs-0.4.0-13.el6, libbasicobjects-0.1.1-13.el6, libcollection-0.6.2-13.el6 +20
- Red Hat Enterprise Linux HPC Node Optional (v. 6) libbasicobjects-devel-0.1.1-13.el6, libcollection-devel-0.6.2-13.el6, libdhash-devel-0.4.3-13.el6 +12
- Red Hat Enterprise Linux Server (v. 6) ding-libs-0.4.0-13.el6, libbasicobjects-0.1.1-13.el6, libbasicobjects-0.1.1-13.el6.ppc +30
- Red Hat Enterprise Linux Server Optional (v. 6) libbasicobjects-devel-0.1.1-13.el6, libbasicobjects-devel-0.1.1-13.el6.ppc, libcollection-devel-0.6.2-13.el6 +24
- Red Hat Enterprise Linux Workstation (v. 6) ding-libs-0.4.0-13.el6, libbasicobjects-0.1.1-13.el6, libcollection-0.6.2-13.el6 +21
- Red Hat Enterprise Linux Workstation Optional (v. 6) libbasicobjects-devel-0.1.1-13.el6, libcollection-devel-0.6.2-13.el6, libdhash-devel-0.4.3-13.el6 +12
Fixes 1 record
Priority MEDIUM 41
It was found that sssd's sysdb_search_user_by_upn_res() function before 1.16.0 did not sanitize requests when querying its local cache and was vulnerable to injection.
CVSS 3.0HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01511 · Published 2018-07-27 · Partial fix CWE-20
