ALT-PU-2019-1550-2

Package sssd updated to version 2.1.0-alt1 for branch sisyphus in task 225325.

Уязвимость сервиса управления доступом к удаленным каталогам и механизма аутентификации sssd, связанная с передачей конфиденциальной информации неавторизованному субъекту, позволяющая нарушителю раскрыть защищаемую информацию

Severity: MEDIUM (5.2)Vector: AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Severity: MEDIUM (5.5)Vector: AV:A/AC:L/Au:S/C:C/I:N/A:N

References:

CVE-2019-3811

A vulnerability was found in sssd. If a user was configured with no home directory set, sssd would return '/' (the root directory) instead of '' (the empty string / no home directory). This could impact services that restrict the user's filesystem access to within their home directory through chroot() etc. All versions before 2.1 are vulnerable.

Severity: LOW (2.7)Vector: AV:A/AC:L/Au:S/C:N/I:N/A:P

Severity: MEDIUM (5.2)Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

References:

Version: 2.1.2

Package sssd update in sisyphus on 2019-03-30

ALT-PU-2019-1550-2

Closed vulnerabilities

BDU:2023-03476

CVE-2019-3811