Skip to content
OpenAdvisories
Unscored CVE-2021-3621 EUVD-2021-26924GHSA-g527-g4q2-57xc

A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cache-expire subcommand…

Published Dec 23, 2021 · Updated Nov 3, 2025 · Assigned by redhat

Package: sssd Package: sssd Ecosystem: Debian Ecosystem: Ubuntu

Description

A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cache-expire subcommands. This flaw allows an attacker to trick the root user into running a specially crafted sssctl command, such as via sudo, to gain root access. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Affected products

VendorProductAffectedFixed
— sssd sssd 2.6.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 sssd 2.5.2-1 —
Debian 13 sssd 2.5.2-1 —
Debian 12 sssd 2.5.2-1 —
Debian 11 sssd 2.4.1-2+deb11u1 DLA-4047-1
Debian 10 sssd 1.16.3-3.2+deb10u1 DLA-3436-1
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Debian 9 sssd 1.15.0-3+deb9u2 DLA-2758-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 22.04 LTS sssd 2.4.1-2ubuntu4 —
Ubuntu 20.04 LTS sssd 2.2.3-3ubuntu0.7 USN-5067-1
Ubuntu 18.04 LTS sssd 1.16.1-1ubuntu1.8 USN-5067-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 8 sssd +29 2.4.0-9.el8_4.2 RHSA-2021:3151
RHEL 7 redhat-virtualization-host +1 4.3.18-20210903.0.el7_9 RHSA-2021:3477
RHEL 7 sssd +33 1.16.5-10.el7_9.10 RHSA-2021:3336
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat Rhev Hypervisor 4 redhat-virtualization-host +1 4.4.7-20210804.0.el8_4 RHSA-2021:3235
RHEL 8.2 EUS sssd +29 2.2.3-20.el8_2.1 RHSA-2021:3365
RHEL 8.1 EUS sssd +29 2.2.0-19.el8_1.2 RHSA-2021:3178

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 8 libsss_nss_idmap-devel 2.4.0-9.el8_4.2 ALSA-2021:3151

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 8 sssd 2.4.0-9.el8_4.2 RLSA-2021:3151

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP4 sssd 2.5.2-150400.4.5.14 SUSE-SU-2022:2763-1
SLES 15 SP3 sssd 1.16.1-23.11.1 SUSE-SU-2021:2941-1
SLES 15 SP2 sssd 1.16.1-17.14.1 SUSE-RU-2021:3185-1
SLES 15 SP1 sssd 1.16.1-8.64.1 SUSE-SU-2022:0826-1
SLES 15 sssd 1.16.1-8.64.1 SUSE-SU-2022:0826-1
Show 11 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES 12 SP5 sssd 1.16.1-7.22.4 SUSE-SU-2021:2873-1
SLES 12 SP4 sssd 1.16.1-4.40.1 SUSE-SU-2022:1258-1
SLES for SAP 15 SP1 sssd 1.16.1-8.64.1 SUSE-SU-2022:0826-1
SLES for SAP 15 sssd 1.16.1-8.64.1 SUSE-SU-2022:0826-1
SLES for SAP 12 SP5 sssd 1.16.1-7.22.4 SUSE-SU-2021:2873-1
SLES for SAP 12 SP4 sssd 1.16.1-4.40.1 SUSE-SU-2022:1258-1
SLE HPC 15 SP1 sssd 1.16.1-8.64.1 SUSE-SU-2022:0826-1
SLE HPC 15 sssd 1.16.1-8.64.1 SUSE-SU-2022:0826-1
SUSE OpenStack Cloud Crowbar 9 sssd 1.16.1-4.40.1 SUSE-SU-2022:1258-1
SUSE OpenStack Cloud 9 sssd 1.16.1-4.40.1 SUSE-SU-2022:1258-1
SUSE Enterprise Storage 6 sssd 1.16.1-8.64.1 SUSE-SU-2022:0826-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed sssd 2.9.3-2.1 openSUSE-SU-2024:13446-1
openSUSE Leap 15.4 sssd 2.5.2-150400.4.5.14 SUSE-SU-2022:2763-1
openSUSE Leap 15.3 sssd 1.16.1-23.11.1 openSUSE-SU-2021:2941-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2 sssd +33 1.16.5-10.amzn2.10 ALAS2-2021-1715

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 8 sssd +29 2.4.0-9.0.1.el8_4.2 ELSA-2021-3151
Oracle Linux 7 sssd +33 1.16.5-10.0.1.el7_9.10 ELSA-2021-3336

Advisories 25

References