PT-2019-5664 · Red Hat+5 · Sssd+6

CVE-2018-16838 · Publicado 2019-02-04 · Atualizado 2025-07-01

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions sssd (affected versions not specified)

Description A flaw was found in the sssd Group Policy Objects implementation. When the GPO is not readable by SSSD due to too strict permission settings on the server side, SSSD will allow all authenticated users to login instead of denying access. The issue is related to insufficient access control in the sssd service, which may allow a remote attacker to disclose protected information and impact its integrity.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Improper Privilege Management

Enumeração de Fraquezas

CWE-284

CWE-269

Identificadores relacionados

ALT-PU-2019-4167

BDU:2020-04879

CESA-2019_2177

CESA-2019_3651

CVE-2018-16838

DLA-3436-1

MGASA-2019-0395

OPENSUSE-SU-2019:1589-1

OPENSUSE-SU-2019_1576-1

OPENSUSE-SU-2019_1589-1

OPENSUSE-SU-2024:13446-1

RHSA-2019:2177

RHSA-2019:2437

RHSA-2019:3651

RHSA-2019_2177

RHSA-2019_3651

SUSE-SU-2019:1476-1

SUSE-SU-2019:1477-1

SUSE-SU-2019:1480-1

SUSE-SU-2019_1476-1

SUSE-SU-2019_1477-1

SUSE-SU-2019_1480-1

USN-5067-1

Produtos afetados

Alt Linux

Centos

Linuxmint

Red Hat

Suse

Ubuntu

Sssd

Referências · 47

• https://github.com/SSSD/sssd/issues/4857 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-16838 · Nota de Segurança
• https://access.redhat.com/errata/RHSA-2019:2177 · Aviso do Fabricante
• https://suse.com/support/update/announcement/2019/suse-su-20191480-1 · Nota
• https://lists.debian.org/debian-lts-announce/2023/05/msg00028.html · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-16838 · Aviso do Fabricante
• https://pagure.io/SSSD/sssd/c/ad058011b6b75b15c674be46a3ae9b3cc5228175 · Nota
• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00042.html · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2018-16838 · Aviso do Fabricante
• https://pagure.io/SSSD/sssd/issue/3867 · Nota
• https://access.redhat.com/errata/RHSA-2019:3651 · Aviso do Fabricante
• https://advisories.mageia.org/MGASA-2019-0395.html · Nota de Segurança
• https://osv.dev/vulnerability/openSUSE-SU-2024:13446-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/MGASA-2019-0395 · Aviso do Fabricante
• https://osv.dev/vulnerability/openSUSE-SU-2019:1589-1 · Aviso do Fabricante