SSSD / sssd

#3549 CVE-2017-12173: Unsanitized input when searching in local cache database
Closed: Fixed Opened by jhrozek.

Closed: Fixed
Reopen Issue

Summary: SSSD stores its cached data in an LDAP like local database
file using libldb. To lookup cached data LDAP search filters
like '(objectClass=user)(name=user_name)' are used. However, in
sysdb_search_user_by_upn_res(), the input is not sanitized and allows
to manipulate the search filter for cache lookups. This would allow
a logged in user to discover the password hash of a different user.

For more details, see: https://lists.fedorahosted.org/archives/list/sssd-devel@lists.fedorahosted.org/message/IKWCIYZ3E6ATZECU2SIWCJ22POSDTI2V/

master:

  • 1f2662c8f97c9c0fa250055d4b6750abfc6d0835

and fix for removing dead code

  • b739b3e767c053bb3a7e6651514896b30502d838
Edited by lslebodn

Metadata Update from @jhrozek:
- Issue close_status updated to: Fixed
- Issue set to the milestone: SSSD 1.15.4
- Issue status updated to: Closed (was: Open)

Metadata Update from @jhrozek:
- Issue set to the milestone: SSSD 1.16.0 (was: SSSD 1.15.4)

Metadata Update from @jhrozek:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1499659

Issue linked to Bugzilla: Bug 1499659

Metadata Update from @jhrozek:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1499659, https://bugzilla.redhat.com/show_bug.cgi?id=1499658 (was: https://bugzilla.redhat.com/show_bug.cgi?id=1499659)

Issue linked to Bugzilla: Bug 1499658

Metadata Update from @jhrozek:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1499659, https://bugzilla.redhat.com/show_bug.cgi?id=1499658, https://bugzilla.redhat.com/show_bug.cgi?id=1507435 (was: https://bugzilla.redhat.com/show_bug.cgi?id=1499659, https://bugzilla.redhat.com/show_bug.cgi?id=1499658)

Issue linked to Bugzilla: Bug 1507435

Metadata Update from @jhrozek:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1499659, https://bugzilla.redhat.com/show_bug.cgi?id=1499658, https://bugzilla.redhat.com/show_bug.cgi?id=1507435, https://bugzilla.redhat.com/show_bug.cgi?id=1489666 (was: https://bugzilla.redhat.com/show_bug.cgi?id=1499659, https://bugzilla.redhat.com/show_bug.cgi?id=1499658, https://bugzilla.redhat.com/show_bug.cgi?id=1507435)

Issue linked to Bugzilla: Bug 1489666

sssd-1-14:

  • e45e50e4523e36f310d7ff0b052500c024c434bf
  • e358dd7b4992da4c4aa7b7f769bd597222715127
  • 353853d479225ba7a625658e58a3af989de909a5
  • 4814454b846cbe9682e0bbcfcf9e0fe98b5181f3
  • 64ef6ab9a432d6fdd231d5f96887ecabeb2fc39e
  • f84055ee1c4ad60219e5d9b2ea5cc4dd6e1112eb

sssd-1-13:

  • 3cf0aa1904fe791eed414bfb532c91a79ea2df9c
  • 0c0b9a3323dfc7988a58d4b67e9c94d0567ee82c
  • 76b79f5a816152d5aa07618b7825fb4926d15f1e
  • 0a539e693254275248ff5756e2e35a9a8f991bb0
  • 50841c025e20e7619ca342739e9beaa9dfb85f1c
  • 853ab167b05b61e3e174b575fbe2fc81abe24f02

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/4575

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.
Metadata
None
None
None
None
None
https://bugzilla.redhat.com/show_bug.cgi?id=1499659, https://bugzilla.redhat.com/show_bug.cgi?id=1499658, https://bugzilla.redhat.com/show_bug.cgi?id=1507435, https://bugzilla.redhat.com/show_bug.cgi?id=1489666
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.