Debian Patches

Status for sssd/2.13.1-3

Patch Description Author Forwarded Bugs Origin Last update
fix-ftbfs-src-m4.diff Avoid FTBFS due to unfound Makefile target src/m4.Abstract:
Without this patch, the build aborts half-way with below error message
```
make[3]: *** No rule to make target 'src/m4', needed by 'all-am'. Stop.
make[3]: *** Waiting for unfinished jobs....
```		 Mike Gabriel <mike.gabriel@das-netzwerkteam.de> no
fix-underlinking-keyutils.diff Underlinking fixes for some unit tests (missing: -lkeyutils) Mike Gabriel <mike.gabriel@das-netzwerkteam.de> no
fix-eol-flaws-in-codefiles.diff Fix EOL at EOF flaw to make src/test/whitespace_test happy Mike Gabriel <mike.gabriel@das-netzwerkteam.de> no
fix-whitespace-test.diff no
default-to-socket-activated-services.diff no
CVE-2026-12610.diff PAM: fix use-after-free during p11_child processing
`pam_check_cert_send()` stored `pctx->sss_certmap_ctx` in the
request state. If `p11_refresh_certmap_ctx()` ran while `p11_child`
was still executing (e.g. triggered by a domain refresh), it freed
and replaced the certmap context, leaving the request state holding
a dangling pointer. `p11_child_done()` could later use that pointer.

Fix this by passing the `pam_ctx` into `pam_check_cert_send()` and
dereferencing `pctx->sss_certmap_ctx` at the time it is actually needed
in `p11_child_done()`, so the current context is always used.


(cherry picked from commit fa7a55949a30fed064a28ea6f0c801fc5e8c5ba7)		 Alexey Tikhonov <atikhono@redhat.com> no 2026-06-29
CVE-2026-14474.diff sudo: warn when ldap_sudo_search_base falls back to root DN
When ldap_sudo_search_base is not explicitly configured, SSSD falls back
to the domain's naming context (root DN) and searches the entire LDAP
directory tree for sudoRole objects. Any LDAP principal with write access
to any subtree can inject a sudoRole granting arbitrary sudo privileges
on every enrolled host.

This patch adds a warning log when the fallback occurs, alerting
administrators that their configuration searches the entire directory
tree for sudo rules. A future hardening step would be to default to
ou=sudoers,<base_dn> instead of the root DN.

The warning approach preserves backwards compatibility while ensuring
administrators are aware of the security implications.

Based on the patch by: Ian Murphy <imurphy@redhat.com>
Amended by: Alexey Tikhonov <atikhono@redhat.com>

:fixes: CVE-2026-14474

(cherry picked from commit ff8c1b19bcdbf79b733b052a7d926bd920b1205d)		 Alexey Tikhonov <atikhono@redhat.com> no 2026-07-03
CVE-2026-14476.diff gpo: reject path traversal in gPCFileSysPath
The gPCFileSysPath LDAP attribute from AD Group Policy Objects is parsed
by ad_gpo_extract_smb_components() which converts backslashes to forward
slashes but does not reject ".." path traversal sequences. The resulting
smb_path is used directly in gpo_cache_store_file() to construct a local
filesystem path under GPO_CACHE_PATH, allowing an attacker with GPO
write access to write files outside the cache directory.

Due to differential path resolution between libsmbclient (which clamps
".." at the SMB share root) and the kernel (which resolves ".." fully),
the SMB download succeeds while the local file write escapes the cache.
On systems with SELinux enforcing, this enables Kerberos configuration
injection via /var/lib/sss/pubconf/krb5.include.d/ (sssd_public_t,
writable by sssd_t). On systems without SELinux, this enables arbitrary
file writes including cron job injection for root code execution.

This patch adds two layers of defense:

1. Reject ".." as a path component in smb_path at parse time in
ad_gpo_extract_smb_components(). Uses component-aware validation
that checks for "/..", "../", and exact ".." — not substring matching
which would false-positive on legitimate names containing "..".

2. Validate the resolved cache path stays within GPO_CACHE_PATH in
gpo_cache_store_file() using realpath(), with a trailing-slash
prefix check to prevent prefix-collision attacks (e.g.,
/var/lib/sss/gpo_cache_evil/ matching /var/lib/sss/gpo_cache).

Based on the patch by: Ian Murphy <imurphy@redhat.com>
Amended by: Alexey Tikhonov <atikhono@redhat.com>

:fixes: CVE-2026-14476		 Alexey Tikhonov <atikhono@redhat.com> no 2026-07-02
CVE-2026-68742.diff nss: validate addrlen in sss_nss_protocol_parse_addr()
:fixes: CVE-2026-68742

(cherry picked from commit 2839e8ccffebbb6bd605047b012eaa5fdb56b9d3)		 Alexey Tikhonov <atikhono@redhat.com> no 2026-08-04
CVE-2026-68743.diff pam: validate auth_token_length in extract_authtok_v1()
The check mimics one existing in `extract_authtok_v2()`

:fixes: CVE-2026-68743

(cherry picked from commit bef9d12617f22335e65447609a2724a68c1bf68a)		 Alexey Tikhonov <atikhono@redhat.com> no 2026-08-04
CVE-2026-68744.diff NSS: fix initgroups packet heap disclosure
sss_nss_protocol_fill_initgr() pre-allocates the reply packet for all
group entries in result->count, but groups may be skipped when they are
non-POSIX, incomplete, or filtered by the negative cache.
Shrink the packet after filling it so it contains exactly the data that
was written.

:fixes: CVE-2026-68744

(cherry picked from commit f5be5002a2e43ff9d2a22a95ffe4e0eeb56e0d3d)		 Alexey Tikhonov <atikhono@redhat.com> no 2026-08-03

All known versions for source package 'sssd'

Links