Debian Patches

Status for sssd/2.10.1-2+deb13u1

Patch Description Author Forwarded Bugs Origin Last update
CVE-2026-68744.diff NSS: fix initgroups packet heap disclosure
sss_nss_protocol_fill_initgr() pre-allocates the reply packet for all
group entries in result->count, but groups may be skipped when they are
non-POSIX, incomplete, or filtered by the negative cache.
Shrink the packet after filling it so it contains exactly the data that
was written.

:fixes: CVE-2026-68744

(cherry picked from commit f5be5002a2e43ff9d2a22a95ffe4e0eeb56e0d3d)		 Alexey Tikhonov <atikhono@redhat.com> no 2026-08-03
test_pam_srv-Use-more-random-UIDs-GIDs-for-the-test.diff test_pam_srv: Use more random UIDs/GIDs for the test
On FreeBSD the UID 123 corresponds to the built-in ntpd user and the machine
that runs this test may be running the ntpd daemon.		 Gleb Popov <6yearold@gmail.com> no 2026-01-16
CVE-2026-68743.diff pam: validate auth_token_length in extract_authtok_v1()
The check mimics one existing in `extract_authtok_v2()`

:fixes: CVE-2026-68743

(cherry picked from commit bef9d12617f22335e65447609a2724a68c1bf68a)		 Alexey Tikhonov <atikhono@redhat.com> no 2026-08-04
fix-whitespace-test.diff diff --git a/src/tests/whitespace_test b/src/tests/whitespace_test
index f055ed4c2..fa95494be 100755		 no
default-to-socket-activated-services.diff no
drop-valgrind.diff no
CVE-2025-11561.diff krb5: disable Kerberos localauth an2ln plugin for AD/IPA
If a client is joined to AD or IPA SSSD's localauth plugin can handle
the mapping of Kerberos principals to local accounts. In case it cannot
map the Kerberos principals libkrb5 is currently configured to fall back
to the default localauth plugins 'default', 'rule', 'names',
'auth_to_local', 'k5login' and 'an2ln' (see man krb5.conf for details).
All plugins except 'an2ln' require some explicit configuration by either
the administrator or the local user. To avoid some unexpected mapping is
done by the 'an2ln' plugin this patch disables it in the configuration
snippets for SSSD's localauth plugin.


:relnote: After startup SSSD already creates a Kerberos configuration
snippet typically in /var/lib/sss/pubconf/krb5.include.d/localauth_plugin
if the AD or IPA providers are used. This enables SSSD's localauth plugin.
Starting with this release the an2ln plugin is disabled in the
configuration snippet as well. If this file or its content are included in
the Kerberos configuration it will fix CVE-2025-11561.

(cherry picked from commit 9939c39d1949fad48af2f0b43c788bad0809e310)		 Sumit Bose <sbose@redhat.com> no 2025-10-10
CVE-2026-6245.diff pam: fix out-of-bounds read in pam_passkey_child_read_data
The pam_passkey_child_read_data() function failed to properly handle
raw bytes received from a pipe. The data was treated as a NUL-terminated
C string without explicit termination, resulting in an out-of-bounds read
when processed by snprintf() with %s format.

Fix by using memcpy instead of snprintf and explicitly NUL-terminating
the buffer. Add checks for buf_len == 0 or buf == NULL to avoid undefined
behavior. Check the return value of sss_authtok_set_passkey_reply and
propagate errors properly.


:relnote: Security fix for CVE-2026-6245: out-of-bounds read in PAM passkey responder		 Xu Raoqing <609179072@qq.com> no 2026-04-21
CVE-2026-12610.diff PAM: fix use-after-free during p11_child processing
`pam_check_cert_send()` stored `pctx->sss_certmap_ctx` in the
request state. If `p11_refresh_certmap_ctx()` ran while `p11_child`
was still executing (e.g. triggered by a domain refresh), it freed
and replaced the certmap context, leaving the request state holding
a dangling pointer. `p11_child_done()` could later use that pointer.

Fix this by passing the `pam_ctx` into `pam_check_cert_send()` and
dereferencing `pctx->sss_certmap_ctx` at the time it is actually needed
in `p11_child_done()`, so the current context is always used.


(cherry picked from commit fa7a55949a30fed064a28ea6f0c801fc5e8c5ba7)		 Alexey Tikhonov <atikhono@redhat.com> no 2026-06-29
CVE-2026-14474.diff sudo: warn when ldap_sudo_search_base falls back to root DN
When ldap_sudo_search_base is not explicitly configured, SSSD falls back
to the domain's naming context (root DN) and searches the entire LDAP
directory tree for sudoRole objects. Any LDAP principal with write access
to any subtree can inject a sudoRole granting arbitrary sudo privileges
on every enrolled host.

This patch adds a warning log when the fallback occurs, alerting
administrators that their configuration searches the entire directory
tree for sudo rules. A future hardening step would be to default to
ou=sudoers,<base_dn> instead of the root DN.

The warning approach preserves backwards compatibility while ensuring
administrators are aware of the security implications.

Based on the patch by: Ian Murphy <imurphy@redhat.com>
Amended by: Alexey Tikhonov <atikhono@redhat.com>

:fixes: CVE-2026-14474

(cherry picked from commit ff8c1b19bcdbf79b733b052a7d926bd920b1205d)		 Alexey Tikhonov <atikhono@redhat.com> no 2026-07-03
CVE-2026-14476.diff gpo: reject path traversal in gPCFileSysPath
The gPCFileSysPath LDAP attribute from AD Group Policy Objects is parsed
by ad_gpo_extract_smb_components() which converts backslashes to forward
slashes but does not reject ".." path traversal sequences. The resulting
smb_path is used directly in gpo_cache_store_file() to construct a local
filesystem path under GPO_CACHE_PATH, allowing an attacker with GPO
write access to write files outside the cache directory.

Due to differential path resolution between libsmbclient (which clamps
".." at the SMB share root) and the kernel (which resolves ".." fully),
the SMB download succeeds while the local file write escapes the cache.
On systems with SELinux enforcing, this enables Kerberos configuration
injection via /var/lib/sss/pubconf/krb5.include.d/ (sssd_public_t,
writable by sssd_t). On systems without SELinux, this enables arbitrary
file writes including cron job injection for root code execution.

This patch adds two layers of defense:

1. Reject ".." as a path component in smb_path at parse time in
ad_gpo_extract_smb_components(). Uses component-aware validation
that checks for "/..", "../", and exact ".." — not substring matching
which would false-positive on legitimate names containing "..".

2. Validate the resolved cache path stays within GPO_CACHE_PATH in
gpo_cache_store_file() using realpath(), with a trailing-slash
prefix check to prevent prefix-collision attacks (e.g.,
/var/lib/sss/gpo_cache_evil/ matching /var/lib/sss/gpo_cache).

Based on the patch by: Ian Murphy <imurphy@redhat.com>
Amended by: Alexey Tikhonov <atikhono@redhat.com>

:fixes: CVE-2026-14476		 Alexey Tikhonov <atikhono@redhat.com> no 2026-07-02
CVE-2026-68742.diff nss: validate addrlen in sss_nss_protocol_parse_addr()
:fixes: CVE-2026-68742

(cherry picked from commit 2839e8ccffebbb6bd605047b012eaa5fdb56b9d3)		 Alexey Tikhonov <atikhono@redhat.com> no 2026-08-04

All known versions for source package 'sssd'

Links