Description
Authconfig version 6.2.8 is vulnerable to an Information exposure while using SSSD to authenticate against remote server resulting in the leak of information about existing usernames.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| authconfig | authconfig | 6.2.8 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | authconfig +1 | 6.2.8-30.el7 | RHSA-2017:2285 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | authconfig +1 | 6.2.8-30.el7 | ELSA-2017-2285 |
Advisories 2
- RHSA-2017:2285 Red Hat Security Advisory: authconfig security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- ELSA-2017-2285 Moderate: authconfig security, bug fix, and enhancement update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Aug 7, 2017