PT-2025-36998 · Microsoft+2 · Intune+3

Janek-Git · Published 2025-09-09 · Updated 2025-11-27 · CVE-2025-59044

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Himmelblau versions 0.9.0 through 0.9.22

Description: Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. The software derives numeric GIDs for Entra ID groups from the group display name when himmelblau.conf id attr map = name (the default configuration). Microsoft Entra ID allows multiple groups with the same displayName, which can cause distinct directory groups to collapse to the same numeric GID on Linux. This can lead to unintentional access to resources or services on a Himmelblau-joined host that enforce authorization by numeric GID for a user who creates or joins a different Entra/O365 group sharing the same displayName as a privileged security group.

Recommendations: Upgrade to Himmelblau version 0.9.23, or 1.0.0 or later. As a workaround, use tenant policy hardening to restrict arbitrary group creation until all hosts are patched.

Exploit

Fix

Weakness Enumeration

CWE-1188

Related Identifiers

CVE-2025-59044

GHSA-2M43-MMG9-3RGC

GHSA-GCXR-M95V-QCF7

OPENSUSE-SU-2025-20114-1

OPENSUSE-SU-2025:20114-1

SUSE-SU-2025:21158-1

Affected Products

Himmelblau

Intune

Azure Entra Id

Suse

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59044.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-59044 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:21158-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59044 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025-20114-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:20114-1 · Vendor Advisory
• https://github.com/himmelblau-idm/himmelblau/commit/76c5b41df7f89378af65dc7c0d0484d7d41b3281 · Note
• https://github.com/himmelblau-idm/himmelblau/security/advisories/GHSA-2m43-mmg9-3rgc · Note
• https://github.com/himmelblau-idm/himmelblau/security/advisories/GHSA-gcxr-m95v-qcf7 · Note
• https://bugzilla.suse.com/1249013 · Note
• https://bugzilla.suse.com/1250687 · Note
• https://suse.com/support/update/announcement/2025/suse-su-202521158-1 · Note
• https://suse.com/security/cve/CVE-2025-58160 · Note
• https://twitter.com/CVEnew/status/1965557668937867518 · Twitter Post
• https://twitter.com/AlexandraM83744/status/1965559166602506630 · Twitter Post