sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters

According to the versions of the sssd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters (CVE-2022-4254)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-6156-1 advisory.

    It was discovered that SSSD incorrrectly sanitized certificate data used in LDAP filters. When using this     issue in combination with FreeIPA, a remote attacker could possibly use this issue to escalate privileges.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the sssd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters (CVE-2022-4254)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3436 advisory.

  - A flaw was found in sssd Group Policy Objects implementation. When the GPO is not readable by SSSD due to     a too strict permission settings on the server side, SSSD will allow all authenticated users to login     instead of denying access. (CVE-2018-16838)

  - A vulnerability was found in sssd. If a user was configured with no home directory set, sssd would return     '/' (the root directory) instead of '' (the empty string / no home directory). This could impact services     that restrict the user's filesystem access to within their home directory through chroot() etc. All     versions before 2.1 are vulnerable. (CVE-2019-3811)

  - A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-     fetch and cache-expire subcommands. This flaw allows an attacker to trick the root user into running a     specially crafted sssctl command, such as via sudo, to gain root access. The highest threat from this     vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2021-3621)

  - sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters (CVE-2022-4254)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of sssd installed on the remote host is prior to 1.16.4-21.27. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1723 advisory.

    A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-     fetch and cache-expire subcommands. This flaw allows an attacker to trick the root user into running a     specially crafted sssctl command, such as via sudo, to gain root access. The highest threat from this     vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2021-3621)

    A vulnerability was found in SSSD, in the libsss_certmap functionality. PKINIT enables a client to     authenticate to the KDC using an X.509 certificate and the corresponding private key, rather than a     passphrase or keytab. FreeIPA uses mapping rules to map a certificate presented during a PKINIT     authentication request to the corresponding principal. The mapping filter is vulnerable to LDAP filter     injection. The search result can be influenced by values in the certificate, which may be attacker     controlled. In the most extreme case, an attacker could gain control of the admin account, leading to full     domain takeover. (CVE-2022-4254)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of sssd installed on the remote host is prior to 1.16.5-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1995 advisory.

    A vulnerability was found in SSSD, in the libsss_certmap functionality. PKINIT enables a client to     authenticate to the KDC using an X.509 certificate and the corresponding private key, rather than a     passphrase or keytab. FreeIPA uses mapping rules to map a certificate presented during a PKINIT     authentication request to the corresponding principal. The mapping filter is vulnerable to LDAP filter     injection. The search result can be influenced by values in the certificate, which may be attacker     controlled. In the most extreme case, an attacker could gain control of the admin account, leading to full     domain takeover. (CVE-2022-4254)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:0292-1 advisory.

  - sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters (CVE-2022-4254)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:0300-1 advisory.

  - sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters (CVE-2022-4254)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:0301-1 advisory.

  - sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters (CVE-2022-4254)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:0403 advisory.

  - sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters (CVE-2022-4254)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:0204-1 advisory.

  - sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters (CVE-2022-4254)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:0200-1 advisory.

  - sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters (CVE-2022-4254)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Scientific Linux 7 host has packages installed that are affected by a vulnerability as referenced in the SLSA-2023:0403-1 advisory.

  - sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters (CVE-2022-4254)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:0442 advisory.

    The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote     directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the     Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to     connect to multiple different account sources.

    Security Fix(es):

    * sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters (CVE-2022-4254)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:0403 advisory.

    The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote     directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the     Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to     connect to multiple different account sources.

    Security Fix(es):

    * sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters (CVE-2022-4254)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * smartcards: special characters must be escaped when building search filter (BZ#2149703)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-0403 advisory.

    [1.16.5-10.0.3]
    - Revert Redhat's change of disallowing duplicated incomplete gid       when 'id_provider=ldap' is used, which caused regression in AD       environment. [Orabug: 29286774] [Doc ID 2605732.1]

    [1.16.5-10.15]
    - Resolves: rhbz#2149703 - smartcards: special characters must be escaped when building search filter     [rhel-7.9.z]
    - Resolves: rhbz#2149902 - EMBARGOED CVE-2022-4254 sssd: libsss_certmap fails to sanitise certificate data     used in LDAP filters [rhel-7.9.z]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:0397 advisory.

    The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote     directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the     Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to     connect to multiple different account sources.

    Security Fix(es):

    * sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters (CVE-2022-4254)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
178997	EulerOS Virtualization 2.10.1 : sssd (EulerOS-SA-2023-2456)	Nessus	Huawei Local Security Checks	high
178993	EulerOS Virtualization 2.10.0 : sssd (EulerOS-SA-2023-2481)	Nessus	Huawei Local Security Checks	high
178877	EulerOS Virtualization 3.0.6.6 : sssd (EulerOS-SA-2023-2438)	Nessus	Huawei Local Security Checks	high
177154	EulerOS Virtualization 3.0.6.0 : sssd (EulerOS-SA-2023-2249)	Nessus	Huawei Local Security Checks	high
177114	Ubuntu 20.04 LTS : SSSD vulnerability (USN-6156-1)	Nessus	Ubuntu Local Security Checks	high
177040	EulerOS 2.0 SP5 : sssd (EulerOS-SA-2023-2172)	Nessus	Huawei Local Security Checks	high
176599	EulerOS Virtualization 2.9.0 : sssd (EulerOS-SA-2023-2026)	Nessus	Huawei Local Security Checks	high
176580	EulerOS Virtualization 2.9.1 : sssd (EulerOS-SA-2023-2005)	Nessus	Huawei Local Security Checks	high
176457	Debian DLA-3436-1 : sssd - LTS security update	Nessus	Debian Local Security Checks	high
176033	EulerOS 2.0 SP10 : sssd (EulerOS-SA-2023-1985)	Nessus	Huawei Local Security Checks	high
176007	EulerOS 2.0 SP10 : sssd (EulerOS-SA-2023-1963)	Nessus	Huawei Local Security Checks	high
175518	EulerOS 2.0 SP9 : sssd (EulerOS-SA-2023-1854)	Nessus	Huawei Local Security Checks	high
175494	EulerOS 2.0 SP9 : sssd (EulerOS-SA-2023-1879)	Nessus	Huawei Local Security Checks	high
174212	EulerOS 2.0 SP8 : sssd (EulerOS-SA-2023-1610)	Nessus	Huawei Local Security Checks	high
173941	Amazon Linux AMI : sssd (ALAS-2023-1723)	Nessus	Amazon Linux Local Security Checks	high
173238	Amazon Linux 2 : sssd (ALAS-2023-1995)	Nessus	Amazon Linux Local Security Checks	high
171192	SUSE SLES15 Security Update : sssd (SUSE-SU-2023:0292-1)	Nessus	SuSE Local Security Checks	high
171183	SUSE SLES15 Security Update : sssd (SUSE-SU-2023:0300-1)	Nessus	SuSE Local Security Checks	high
171138	SUSE SLES12 Security Update : sssd (SUSE-SU-2023:0301-1)	Nessus	SuSE Local Security Checks	high
170864	CentOS 7 : sssd (RHSA-2023:0403)	Nessus	CentOS Local Security Checks	high
170745	SUSE SLES15 Security Update : sssd (SUSE-SU-2023:0204-1)	Nessus	SuSE Local Security Checks	high
170744	SUSE SLES12 Security Update : sssd (SUSE-SU-2023:0200-1)	Nessus	SuSE Local Security Checks	high
170642	Scientific Linux Security Update : sssd on SL7.x i686/x86_64 (2023:0403)	Nessus	Scientific Linux Local Security Checks	high
170535	RHEL 8 : sssd (RHSA-2023:0442)	Nessus	Red Hat Local Security Checks	high
170522	RHEL 7 : sssd (RHSA-2023:0403)	Nessus	Red Hat Local Security Checks	high
170521	Oracle Linux 7 : sssd (ELSA-2023-0403)	Nessus	Oracle Linux Local Security Checks	high
170479	RHEL 8 : sssd (RHSA-2023:0397)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2022-4254

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high