Unknown Sssd vulnerabilities

3 vulnerabilities

Known vulnerabilities in Unknown Sssd, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

5.5CVE-2018-16883debiansssd+3
EPSS score
0.39%
sssd versions from 1.13.0 to before 2.0.0 did not properly restrict access to the infopipe according to the "allowed_uids" configuration parameter. If sensitive information were stored in the user directory, this could be inadvertently disclosed to local attackers.5.5CVE-2018-16838debiansssd+75
EPSS score
1.15%
A flaw was found in sssd Group Policy Objects implementation. When the GPO is not readable by SSSD due to a too strict permission settings on the server side, SSSD will allow all authenticated users to login instead of denying access.7.5CVE-2018-10852debiansssd+52
EPSS score
1.50%
The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD has too wide permissions, which means that anyone who can send a message using the same raw protocol that sudo and SSSD use can read the sudo rules available for any user. This affects versions of SSSD before 1.16.3.