Description
The pam_parse_in_data_v2 function in src/responder/pam/pamsrv_cmd.c in the PAM responder in SSSD 1.5.0, 1.4.x, and 1.3 allows local users to cause a denial of service (infinite loop, crash, and login prevention) via a crafted packet.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | sssd | 1.2.1-4.1 | — |
| Debian 13 | sssd | 1.2.1-4.1 | — |
| Debian 12 | sssd | 1.2.1-4.1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | sssd +2 | 1.5.1-34.el6 | RHSA-2011:0560 |
| RHEL 5 | sssd +2 | 1.5.1-37.el5 | RHSA-2011:0975 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | sssd | 1.14.2-3.1 | openSUSE-SU-2024:10427-1 |
Advisories 3
- RHSA-2011:0560 Red Hat Security Advisory: sssd security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2011:0975 Red Hat Security Advisory: sssd security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- openSUSE-SU-2024:10427-1 libipa_hbac-devel-1.14.2-3.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 43068 third-party-advisory
- 45961 vdb-entry
- 43055 third-party-advisory
- ADV-2011-0212 vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=661163
- FEDORA-2011-0364 vendor-advisory
- sssd-pamparseindatav2-dos(64881) vdb-entry
- RHSA-2011:0560 vendor-advisory
- FEDORA-2011-0337 vendor-advisory
- ADV-2011-0197 vdb-entry
- RHSA-2011:0975 vendor-advisory
- SUSE-SR:2011:002 vendor-advisory
- 43053 third-party-advisory