Skip to content
OpenAdvisories
Medium ALAS2023-2026-3416 25 CVEs

Moderate: sssd security update (Amazon Linux 2023)

Published Nov 9, 2026 · Updated Nov 9, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-92821: A flaw was found in SSSD. When configured to evaluate password expiration warnings before restrictive access rules in LDAP (Lightweight Directory Access Protocol) environments, an expired-password warning terminates rule evaluation early and treats the access request as successful. A remote authenticated user with an expired password using an alternative authentication method, such as SSH public key authentication, can exploit this flaw to bypass access control restrictions and gain unauthorized access to protected systems. CVE-2026-90996: A flaw was found in sssd. A local unprivileged user could send a specially crafted request with a zero-length body to the Network Security Services (NSS) responder. This could lead to a denial-of-service condition, causing the NSS responder to become unstable or terminate. This vulnerability affects the availability of the system responder. CVE-2026-90995: A flaw was found in SSSD (System Security Services Daemon). A local attacker with privileges to connect to the PAM (Pluggable Authentication Modules) responder socket can send a specially crafted protocol request. If the `pam_app_services` configuration is enabled and the service item is omitted from the request, a NULL pointer dereference can occur. This vulnerability leads to a denial of service, causing the PAM responder to crash and disrupt authentication services. CVE-2026-90994: A flaw was found in sssd, specifically within the PAM (Pluggable Authentication Modules) responder's protocol v1 parser, pam_parse_in_data(). A local client with access to the PAM responder's UNIX socket can exploit this by negotiating protocol v1 and sending an empty or truncated PAM request body. This can trigger an out-of-bounds read, potentially causing the PAM responder to terminate or restart, leading to a local denial of service. CVE-2026-90463: A flaw was found in the sssd NSS responder. This input validation vulnerability allows a local attacker, by sending specially crafted service lookup requests to the NSS responder's UNIX socket, to cause an out-of-bounds read. This out-of-bounds read may lead to a denial of service (DoS) by crashing the NSS responder process. While unprivileged local clients can typically reach the socket, there is no evidence of privilege escalation or reliable data disclosure. CVE-2026-90462: A flaw was found in SSSD. When configured with the LDAP access provider and `ldap_access_order` including `ppolicy` or `lockout`, a fail-open condition in the LDAP ppolicy access check can occur if a user lookup returns zero results. This can incorrectly return success and cache an allow decision, permitting continued authorization for a deleted or deprovisioned user. A remote attacker with prior valid account context could exploit this to maintain access to information and potentially make limited modifications to resources that should no longer be available. CVE-2026-88252: A flaw was found in sssd. A local user can cause a Denial of Service (DoS) by exhausting the responder service's available file descriptors (system handles used for open connections). By opening and maintaining many concurrent connections to a responder socket while continuing to queue new connection attempts, an attacker can trigger an unthrottled retry loop. This condition leads to high CPU utilization and stalls the service, preventing legitimate identity and authentication requests from being processed. CVE-2026-80048: A flaw was found in `sssd-kcm`. A local user or process able to connect to the `sssd-kcm` UNIX socket can exploit this vulnerability. By sending a large request length header and then stalling the connection, an attacker can cause the system to preallocate significant memory. This leads to memory exhaustion within the `sssd-kcm` responder, resulting in a Denial of Service (DoS) for affected deployments. CVE-2026-68744: A flaw was found in SSSD. The sss_nss_protocol_fill_initgr() function in the NSS responder pre-allocates reply space for all group entries but does not shrink the packet when groups are skipped, causing uninitialized heap bytes to be transmitted to the client. A local attacker can exploit this to disclose cached directory data and heap layout information from the sssd_nss process. CVE-2026-68743: A flaw was found in SSSD. The extract_authtok_v1() function in the PAM responder does not validate the auth_token_length field against the remaining buffer size before processing. A local attacker can exploit this via a crafted protocol v1 request to the PAM responder socket, causing an out-of-bounds read and process crash, resulting in a denial of service. CVE-2026-68742: A flaw was found in SSSD. The sss_nss_protocol_parse_addr() function in the NSS responder does not validate the addrlen field against the remaining packet body size. A local attacker can exploit this via a crafted GETHOSTBYADDR request to the NSS responder socket, causing an out-of-bounds read and process crash, resulting in a denial of service. CVE-2026-104048: A flaw was found in SSSD. In trust-enabled identity management environments, SSSD evaluates Host-Based Access Control (HBAC) rules by stripping domain qualifiers and comparing only short usernames. An authenticated user in a trusted domain who shares the same username as an authorized local account can bypass access policies and gain unauthorized access to protected services or hosts. CVE-2026-104045: A flaw was found in SSSD. A local user can trigger a Denial of Service (DoS) by exploiting a race condition in the autofs responder between asynchronous enumeration completion and map invalidation. By repeatedly sending concurrent map enumeration and invalidation requests, an attacker can cause memory to leak, leading to excessive memory consumption that can disrupt or crash the autofs service. CVE-2026-104043: A flaw was found in SSSD. A local attacker with access to the

Fixed packages 61

ReleasePackageFixed in
Amazon Linux · 2023 libipa_hbac 0:2.9.4-1.amzn2023.0.5
Amazon Linux · 2023 libipa_hbac-debuginfo 0:2.9.4-1.amzn2023.0.5
Amazon Linux · 2023 libipa_hbac-devel 0:2.9.4-1.amzn2023.0.5
Amazon Linux · 2023 libsss_autofs 0:2.9.4-1.amzn2023.0.5
Amazon Linux · 2023 libsss_autofs-debuginfo 0:2.9.4-1.amzn2023.0.5
Amazon Linux · 2023 libsss_certmap 0:2.9.4-1.amzn2023.0.5
Amazon Linux · 2023 libsss_certmap-debuginfo 0:2.9.4-1.amzn2023.0.5
Amazon Linux · 2023 libsss_certmap-devel 0:2.9.4-1.amzn2023.0.5
Amazon Linux · 2023 libsss_idmap 0:2.9.4-1.amzn2023.0.5
Amazon Linux · 2023 libsss_idmap-debuginfo 0:2.9.4-1.amzn2023.0.5
Amazon Linux · 2023 libsss_idmap-devel 0:2.9.4-1.amzn2023.0.5
Amazon Linux · 2023 libsss_nss_idmap 0:2.9.4-1.amzn2023.0.5
Amazon Linux · 2023 libsss_nss_idmap-debuginfo 0:2.9.4-1.amzn2023.0.5
Amazon Linux · 2023 libsss_nss_idmap-devel 0:2.9.4-1.amzn2023.0.5
Amazon Linux · 2023 libsss_simpleifp 0:2.9.4-1.amzn2023.0.5
Amazon Linux · 2023 libsss_simpleifp-debuginfo 0:2.9.4-1.amzn2023.0.5
Amazon Linux · 2023 libsss_simpleifp-devel 0:2.9.4-1.amzn2023.0.5
Amazon Linux · 2023 libsss_sudo 0:2.9.4-1.amzn2023.0.5
Amazon Linux · 2023 libsss_sudo-debuginfo 0:2.9.4-1.amzn2023.0.5
Amazon Linux · 2023 python3-libipa_hbac 0:2.9.4-1.amzn2023.0.5
Amazon Linux · 2023 python3-libipa_hbac-debuginfo 0:2.9.4-1.amzn2023.0.5
Amazon Linux · 2023 python3-libsss_nss_idmap 0:2.9.4-1.amzn2023.0.5
Amazon Linux · 2023 python3-libsss_nss_idmap-debuginfo 0:2.9.4-1.amzn2023.0.5
Amazon Linux · 2023 python3-sss 0:2.9.4-1.amzn2023.0.5
Amazon Linux · 2023 python3-sss-debuginfo 0:2.9.4-1.amzn2023.0.5
Amazon Linux · 2023 python3-sss-murmur 0:2.9.4-1.amzn2023.0.5
Amazon Linux · 2023 python3-sss-murmur-debuginfo 0:2.9.4-1.amzn2023.0.5
Amazon Linux · 2023 python3-sssdconfig 0:2.9.4-1.amzn2023.0.5
Amazon Linux · 2023 sssd 0:2.9.4-1.amzn2023.0.5
Amazon Linux · 2023 sssd-ad 0:2.9.4-1.amzn2023.0.5
Amazon Linux · 2023 sssd-ad-debuginfo 0:2.9.4-1.amzn2023.0.5
Amazon Linux · 2023 sssd-client 0:2.9.4-1.amzn2023.0.5
Amazon Linux · 2023 sssd-client-debuginfo 0:2.9.4-1.amzn2023.0.5
Amazon Linux · 2023 sssd-common 0:2.9.4-1.amzn2023.0.5
Amazon Linux · 2023 sssd-common-debuginfo 0:2.9.4-1.amzn2023.0.5
Amazon Linux · 2023 sssd-common-pac 0:2.9.4-1.amzn2023.0.5
Amazon Linux · 2023 sssd-common-pac-debuginfo 0:2.9.4-1.amzn2023.0.5
Amazon Linux · 2023 sssd-dbus 0:2.9.4-1.amzn2023.0.5
Amazon Linux · 2023 sssd-dbus-debuginfo 0:2.9.4-1.amzn2023.0.5
Amazon Linux · 2023 sssd-debuginfo 0:2.9.4-1.amzn2023.0.5
Amazon Linux · 2023 sssd-debugsource 0:2.9.4-1.amzn2023.0.5
Amazon Linux · 2023 sssd-idp 0:2.9.4-1.amzn2023.0.5
Amazon Linux · 2023 sssd-idp-debuginfo 0:2.9.4-1.amzn2023.0.5
Amazon Linux · 2023 sssd-ipa 0:2.9.4-1.amzn2023.0.5
Amazon Linux · 2023 sssd-ipa-debuginfo 0:2.9.4-1.amzn2023.0.5
Amazon Linux · 2023 sssd-kcm 0:2.9.4-1.amzn2023.0.5
Amazon Linux · 2023 sssd-kcm-debuginfo 0:2.9.4-1.amzn2023.0.5
Amazon Linux · 2023 sssd-krb5 0:2.9.4-1.amzn2023.0.5
Amazon Linux · 2023 sssd-krb5-common 0:2.9.4-1.amzn2023.0.5
Amazon Linux · 2023 sssd-krb5-common-debuginfo 0:2.9.4-1.amzn2023.0.5
Amazon Linux · 2023 sssd-krb5-debuginfo 0:2.9.4-1.amzn2023.0.5
Amazon Linux · 2023 sssd-ldap 0:2.9.4-1.amzn2023.0.5
Amazon Linux · 2023 sssd-ldap-debuginfo 0:2.9.4-1.amzn2023.0.5
Amazon Linux · 2023 sssd-nfs-idmap 0:2.9.4-1.amzn2023.0.5
Amazon Linux · 2023 sssd-nfs-idmap-debuginfo 0:2.9.4-1.amzn2023.0.5
Amazon Linux · 2023 sssd-proxy 0:2.9.4-1.amzn2023.0.5
Amazon Linux · 2023 sssd-proxy-debuginfo 0:2.9.4-1.amzn2023.0.5
Amazon Linux · 2023 sssd-tools 0:2.9.4-1.amzn2023.0.5
Amazon Linux · 2023 sssd-tools-debuginfo 0:2.9.4-1.amzn2023.0.5
Amazon Linux · 2023 sssd-winbind-idmap 0:2.9.4-1.amzn2023.0.5
Amazon Linux · 2023 sssd-winbind-idmap-debuginfo 0:2.9.4-1.amzn2023.0.5

Vulnerabilities 25

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-104029.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-104031.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-104032.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-104033.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-104034.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-104035.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-104036.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-104037.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-104038.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-104039.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-104042.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-104043.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-104045.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-104048.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-68742.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-68743.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-68744.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-80048.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-88252.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-90462.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-90463.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-90994.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-90995.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-90996.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-92821.html