Skip to content
OpenAdvisories
Medium ALAS2-2019-1343 2 CVEs

Moderate: sssd security update (Amazon Linux 2)

Published Oct 28, 2019 · Updated Oct 30, 2019

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-3811: A vulnerability was found in sssd where, if a user was configured with no home directory set, sssd would return '/' (the root directory) instead of '' (the empty string / no home directory). This could impact services that restrict the user's filesystem access to within their home directory through chroot(). 99999: CVE-2019-3811 sssd: fallback_homedir returns '/' for empty home directories in passwd file CVE-2018-16838: A flaw was found in sssd Group Policy Objects implementation. When the GPO is not readable by SSSD due to a too strict permission settings on the server side, SSSD will allow all authenticated users to login instead of denying access. 99999: CVE-2018-16838 sssd: improper implementation of GPOs due to too restrictive permissions

Fixed packages 35

ReleasePackageFixed in
Amazon Linux · 2 libipa_hbac 0:1.16.4-21.amzn2
Amazon Linux · 2 libipa_hbac-devel 0:1.16.4-21.amzn2
Amazon Linux · 2 libsss_autofs 0:1.16.4-21.amzn2
Amazon Linux · 2 libsss_certmap 0:1.16.4-21.amzn2
Amazon Linux · 2 libsss_certmap-devel 0:1.16.4-21.amzn2
Amazon Linux · 2 libsss_idmap 0:1.16.4-21.amzn2
Amazon Linux · 2 libsss_idmap-devel 0:1.16.4-21.amzn2
Amazon Linux · 2 libsss_nss_idmap 0:1.16.4-21.amzn2
Amazon Linux · 2 libsss_nss_idmap-devel 0:1.16.4-21.amzn2
Amazon Linux · 2 libsss_simpleifp 0:1.16.4-21.amzn2
Amazon Linux · 2 libsss_simpleifp-devel 0:1.16.4-21.amzn2
Amazon Linux · 2 libsss_sudo 0:1.16.4-21.amzn2
Amazon Linux · 2 python-libipa_hbac 0:1.16.4-21.amzn2
Amazon Linux · 2 python-libsss_nss_idmap 0:1.16.4-21.amzn2
Amazon Linux · 2 python-sss 0:1.16.4-21.amzn2
Amazon Linux · 2 python-sss-murmur 0:1.16.4-21.amzn2
Amazon Linux · 2 python-sssdconfig 0:1.16.4-21.amzn2
Amazon Linux · 2 sssd 0:1.16.4-21.amzn2
Amazon Linux · 2 sssd-ad 0:1.16.4-21.amzn2
Amazon Linux · 2 sssd-client 0:1.16.4-21.amzn2
Amazon Linux · 2 sssd-common 0:1.16.4-21.amzn2
Amazon Linux · 2 sssd-common-pac 0:1.16.4-21.amzn2
Amazon Linux · 2 sssd-dbus 0:1.16.4-21.amzn2
Amazon Linux · 2 sssd-debuginfo 0:1.16.4-21.amzn2
Amazon Linux · 2 sssd-ipa 0:1.16.4-21.amzn2
Amazon Linux · 2 sssd-kcm 0:1.16.4-21.amzn2
Amazon Linux · 2 sssd-krb5 0:1.16.4-21.amzn2
Amazon Linux · 2 sssd-krb5-common 0:1.16.4-21.amzn2
Amazon Linux · 2 sssd-ldap 0:1.16.4-21.amzn2
Amazon Linux · 2 sssd-libwbclient 0:1.16.4-21.amzn2
Amazon Linux · 2 sssd-libwbclient-devel 0:1.16.4-21.amzn2
Amazon Linux · 2 sssd-polkit-rules 0:1.16.4-21.amzn2
Amazon Linux · 2 sssd-proxy 0:1.16.4-21.amzn2
Amazon Linux · 2 sssd-tools 0:1.16.4-21.amzn2
Amazon Linux · 2 sssd-winbind-idmap 0:1.16.4-21.amzn2

Vulnerabilities 2

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2018-16838.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-3811.html