ALT-PU-2018-2876-1
Closed vulnerabilities
Published: 2018-06-26
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2018-10852
The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD has too wide permissions, which means that anyone who can send a message using the same raw protocol that sudo and SSSD use can read the sudo rules available for any user. This affects versions of SSSD before 1.16.3.
Severity: HIGH (7.5)
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References:
- 104547
- 104547
- RHSA-2018:3158
- RHSA-2018:3158
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10852
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10852
- [debian-lts-announce] 20180716 [SECURITY] [DLA 1429-1] sssd security update
- [debian-lts-announce] 20180716 [SECURITY] [DLA 1429-1] sssd security update
Closed bugs
sssd не перезапускается при обновлении (до sssd-1.15.3-alt1.M80P.1)
logrotate из коробки не хочет ротировать sssd логи