PT-2019-5664 · Red Hat+5 · Sssd+6

Published 2019-02-04 · Updated 2025-07-01 · CVE-2018-16838

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions sssd (affected versions not specified)

Description A flaw was found in the sssd Group Policy Objects implementation. When the GPO is not readable by SSSD due to too strict permission settings on the server side, SSSD will allow all authenticated users to login instead of denying access. The issue is related to insufficient access control in the sssd service, which may allow a remote attacker to disclose protected information and impact its integrity.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Improper Privilege Management

Weakness Enumeration

CWE-284

CWE-269

Related Identifiers

ALT-PU-2019-4167

BDU:2020-04879

CESA-2019_2177

CESA-2019_3651

CVE-2018-16838

DLA-3436-1

MGASA-2019-0395

OPENSUSE-SU-2019:1589-1

OPENSUSE-SU-2019_1576-1

OPENSUSE-SU-2019_1589-1

OPENSUSE-SU-2024:13446-1

RHSA-2019:2177

RHSA-2019:2437

RHSA-2019:3651

RHSA-2019_2177

RHSA-2019_3651

SUSE-SU-2019:1476-1

SUSE-SU-2019:1477-1

SUSE-SU-2019:1480-1

SUSE-SU-2019_1476-1

SUSE-SU-2019_1477-1

SUSE-SU-2019_1480-1

USN-5067-1

Affected Products

Alt Linux

Centos

Linuxmint

Red Hat

Suse

Ubuntu

Sssd

References · 47

• https://nvd.nist.gov/vuln/detail/CVE-2018-16838 · Security Note
• https://access.redhat.com/errata/RHSA-2019:2177 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-16838 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00042.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-16838 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:3651 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2019-0395.html · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:13446-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2019-0395 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:1589-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-3621 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-04879 · Security Note
• https://ubuntu.com/security/CVE-2018-16838 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20230525SE16MD · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-16838 · Vendor Advisory