CVE-2021-3621: fedoraproject fedora

Modified

AliasesMGASA-2021-0502SUSE-RU-2021:3185-1SUSE-SU-2021:2873-1+12 more

Published 23-12-2021Last modified 03-11-2025

Vulnerability summary

CVE-2021-3621 is a high (CVSS 9.3) vulnerability in fedoraproject fedora. EPSS estimates a 2.63% chance of exploitation in the next 30 days, higher than 85.5% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 8.8, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

9.3/10

010

High · v2.0 (NVD)

EPSS score

2.63%

0%100%

Low · +0.10 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 6 · Related 2

DLA-3436-1 DLA-4047-1 OPENSUSE-SU-2024:13446-1 RHSA-2021:3235 RHSA-2021:3477 USN-5067-1

Timeline

23-12-2021
PublishedVulnerability first disclosed.
03-11-2025
Last modifiedVulnerability information updated.

Description

A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cache-expire subcommands. This flaw allows an attacker to trick the root user into running a specially crafted sssctl command, such as via sudo, to gain root access. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

CVSS metrics

5 scores · 4 sources · 2 versions

v3.16.7v2.09.3

EPSS trend

Probability

2.63%

Chance of exploitation in the next 30 days

Percentile

86%

Versus all other CVEs

30-day change

Increase +0.10 pp

From 2.52% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat74 products

virtualization_host4.0
libipa_hbac< 0:2.2.3-20.el8_2.1 | < 0:2.4.0-9.el8_4.2 | < 0:2.2.0-19.el8_1.2 | < 0:1.16.5-10.el7_9.10
libipa_hbac-debuginfo< 0:2.2.3-20.el8_2.1 | < 0:2.4.0-9.el8_4.2 | < 0:2.2.0-19.el8_1.2
libipa_hbac-devel< 0:1.16.5-10.el7_9.10
libsss_autofs< 0:2.2.3-20.el8_2.1 | < 0:2.4.0-9.el8_4.2 | < 0:2.2.0-19.el8_1.2 | < 0:1.16.5-10.el7_9.10
libsss_autofs-debuginfo< 0:2.2.3-20.el8_2.1 | < 0:2.4.0-9.el8_4.2 | < 0:2.2.0-19.el8_1.2
libsss_certmap< 0:2.2.3-20.el8_2.1 | < 0:2.4.0-9.el8_4.2 | < 0:2.2.0-19.el8_1.2 | < 0:1.16.5-10.el7_9.10
libsss_certmap-debuginfo< 0:2.2.3-20.el8_2.1 | < 0:2.4.0-9.el8_4.2 | < 0:2.2.0-19.el8_1.2
libsss_certmap-devel< 0:1.16.5-10.el7_9.10
libsss_idmap< 0:2.2.3-20.el8_2.1 | < 0:2.4.0-9.el8_4.2 | < 0:2.2.0-19.el8_1.2 | < 0:1.16.5-10.el7_9.10
libsss_idmap-debuginfo< 0:2.2.3-20.el8_2.1 | < 0:2.4.0-9.el8_4.2 | < 0:2.2.0-19.el8_1.2
libsss_idmap-devel< 0:1.16.5-10.el7_9.10
libsss_nss_idmap< 0:2.2.3-20.el8_2.1 | < 0:2.4.0-9.el8_4.2 | < 0:2.2.0-19.el8_1.2 | < 0:1.16.5-10.el7_9.10
libsss_nss_idmap-debuginfo< 0:2.2.3-20.el8_2.1 | < 0:2.4.0-9.el8_4.2 | < 0:2.2.0-19.el8_1.2
libsss_nss_idmap-devel< 0:2.2.3-20.el8_2.1 | < 0:2.4.0-9.el8_4.2 | < 0:2.2.0-19.el8_1.2 | < 0:1.16.5-10.el7_9.10
libsss_simpleifp< 0:2.2.3-20.el8_2.1 | < 0:2.4.0-9.el8_4.2 | < 0:2.2.0-19.el8_1.2 | < 0:1.16.5-10.el7_9.10
libsss_simpleifp-debuginfo< 0:2.2.3-20.el8_2.1 | < 0:2.4.0-9.el8_4.2 | < 0:2.2.0-19.el8_1.2
libsss_simpleifp-devel< 0:1.16.5-10.el7_9.10
libsss_sudo< 0:2.2.3-20.el8_2.1 | < 0:2.4.0-9.el8_4.2 | < 0:2.2.0-19.el8_1.2 | < 0:1.16.5-10.el7_9.10
libsss_sudo-debuginfo< 0:2.2.3-20.el8_2.1 | < 0:2.4.0-9.el8_4.2 | < 0:2.2.0-19.el8_1.2
python-libipa_hbac< 0:1.16.5-10.el7_9.10
python-libsss_nss_idmap< 0:1.16.5-10.el7_9.10
python-sss< 0:1.16.5-10.el7_9.10
python-sss-murmur< 0:1.16.5-10.el7_9.10
python-sssdconfig< 0:1.16.5-10.el7_9.10
python3-libipa_hbac< 0:2.2.3-20.el8_2.1 | < 0:2.4.0-9.el8_4.2 | < 0:2.2.0-19.el8_1.2
python3-libipa_hbac-debuginfo< 0:2.2.3-20.el8_2.1 | < 0:2.4.0-9.el8_4.2 | < 0:2.2.0-19.el8_1.2
python3-libsss_nss_idmap< 0:2.2.3-20.el8_2.1 | < 0:2.4.0-9.el8_4.2 | < 0:2.2.0-19.el8_1.2
python3-libsss_nss_idmap-debuginfo< 0:2.2.3-20.el8_2.1 | < 0:2.4.0-9.el8_4.2 | < 0:2.2.0-19.el8_1.2
python3-sss< 0:2.2.3-20.el8_2.1 | < 0:2.4.0-9.el8_4.2 | < 0:2.2.0-19.el8_1.2
python3-sss-debuginfo< 0:2.2.3-20.el8_2.1 | < 0:2.4.0-9.el8_4.2 | < 0:2.2.0-19.el8_1.2
python3-sss-murmur< 0:2.2.3-20.el8_2.1 | < 0:2.4.0-9.el8_4.2 | < 0:2.2.0-19.el8_1.2
python3-sss-murmur-debuginfo< 0:2.2.3-20.el8_2.1 | < 0:2.4.0-9.el8_4.2 | < 0:2.2.0-19.el8_1.2
python3-sssdconfig< 0:2.2.3-20.el8_2.1 | < 0:2.4.0-9.el8_4.2 | < 0:2.2.0-19.el8_1.2
sssd< 0:2.2.3-20.el8_2.1 | < 0:2.4.0-9.el8_4.2 | < 0:2.2.0-19.el8_1.2 | < 0:1.16.5-10.el7_9.10
sssd-ad< 0:2.2.3-20.el8_2.1 | < 0:2.4.0-9.el8_4.2 | < 0:2.2.0-19.el8_1.2 | < 0:1.16.5-10.el7_9.10
sssd-ad-debuginfo< 0:2.2.3-20.el8_2.1 | < 0:2.4.0-9.el8_4.2 | < 0:2.2.0-19.el8_1.2
sssd-client< 0:2.2.3-20.el8_2.1 | < 0:2.4.0-9.el8_4.2 | < 0:2.2.0-19.el8_1.2 | < 0:1.16.5-10.el7_9.10
sssd-client-debuginfo< 0:2.2.3-20.el8_2.1 | < 0:2.4.0-9.el8_4.2 | < 0:2.2.0-19.el8_1.2
sssd-common< 0:2.2.3-20.el8_2.1 | < 0:2.4.0-9.el8_4.2 | < 0:2.2.0-19.el8_1.2 | < 0:1.16.5-10.el7_9.10
sssd-common-debuginfo< 0:2.2.3-20.el8_2.1 | < 0:2.4.0-9.el8_4.2 | < 0:2.2.0-19.el8_1.2
sssd-common-pac< 0:2.2.3-20.el8_2.1 | < 0:2.4.0-9.el8_4.2 | < 0:2.2.0-19.el8_1.2 | < 0:1.16.5-10.el7_9.10
sssd-common-pac-debuginfo< 0:2.2.3-20.el8_2.1 | < 0:2.4.0-9.el8_4.2 | < 0:2.2.0-19.el8_1.2
sssd-dbus< 0:2.2.3-20.el8_2.1 | < 0:2.4.0-9.el8_4.2 | < 0:2.2.0-19.el8_1.2 | < 0:1.16.5-10.el7_9.10
sssd-dbus-debuginfo< 0:2.2.3-20.el8_2.1 | < 0:2.4.0-9.el8_4.2 | < 0:2.2.0-19.el8_1.2
sssd-debuginfo< 0:2.2.3-20.el8_2.1 | < 0:2.4.0-9.el8_4.2 | < 0:2.2.0-19.el8_1.2 | < 0:1.16.5-10.el7_9.10
sssd-debugsource< 0:2.2.3-20.el8_2.1 | < 0:2.4.0-9.el8_4.2 | < 0:2.2.0-19.el8_1.2
sssd-ipa< 0:2.2.3-20.el8_2.1 | < 0:2.4.0-9.el8_4.2 | < 0:2.2.0-19.el8_1.2 | < 0:1.16.5-10.el7_9.10
sssd-ipa-debuginfo< 0:2.2.3-20.el8_2.1 | < 0:2.4.0-9.el8_4.2 | < 0:2.2.0-19.el8_1.2
sssd-kcm< 0:2.2.3-20.el8_2.1 | < 0:2.4.0-9.el8_4.2 | < 0:2.2.0-19.el8_1.2 | < 0:1.16.5-10.el7_9.10
sssd-kcm-debuginfo< 0:2.2.3-20.el8_2.1 | < 0:2.4.0-9.el8_4.2 | < 0:2.2.0-19.el8_1.2
sssd-krb5< 0:2.2.3-20.el8_2.1 | < 0:2.4.0-9.el8_4.2 | < 0:2.2.0-19.el8_1.2 | < 0:1.16.5-10.el7_9.10
sssd-krb5-common< 0:2.2.3-20.el8_2.1 | < 0:2.4.0-9.el8_4.2 | < 0:2.2.0-19.el8_1.2 | < 0:1.16.5-10.el7_9.10
sssd-krb5-common-debuginfo< 0:2.2.3-20.el8_2.1 | < 0:2.4.0-9.el8_4.2 | < 0:2.2.0-19.el8_1.2
sssd-krb5-debuginfo< 0:2.2.3-20.el8_2.1 | < 0:2.4.0-9.el8_4.2 | < 0:2.2.0-19.el8_1.2
sssd-ldap< 0:2.2.3-20.el8_2.1 | < 0:2.4.0-9.el8_4.2 | < 0:2.2.0-19.el8_1.2 | < 0:1.16.5-10.el7_9.10
sssd-ldap-debuginfo< 0:2.2.3-20.el8_2.1 | < 0:2.4.0-9.el8_4.2 | < 0:2.2.0-19.el8_1.2
sssd-libwbclient< 0:2.2.3-20.el8_2.1 | < 0:2.4.0-9.el8_4.2 | < 0:2.2.0-19.el8_1.2 | < 0:1.16.5-10.el7_9.10
sssd-libwbclient-debuginfo< 0:2.2.3-20.el8_2.1 | < 0:2.4.0-9.el8_4.2 | < 0:2.2.0-19.el8_1.2
sssd-libwbclient-devel< 0:1.16.5-10.el7_9.10
sssd-nfs-idmap< 0:2.2.3-20.el8_2.1 | < 0:2.4.0-9.el8_4.2 | < 0:2.2.0-19.el8_1.2
sssd-nfs-idmap-debuginfo< 0:2.2.3-20.el8_2.1 | < 0:2.4.0-9.el8_4.2 | < 0:2.2.0-19.el8_1.2
sssd-polkit-rules< 0:2.2.3-20.el8_2.1 | < 0:2.4.0-9.el8_4.2 | < 0:2.2.0-19.el8_1.2 | < 0:1.16.5-10.el7_9.10
sssd-proxy< 0:2.2.3-20.el8_2.1 | < 0:2.4.0-9.el8_4.2 | < 0:2.2.0-19.el8_1.2 | < 0:1.16.5-10.el7_9.10
sssd-proxy-debuginfo< 0:2.2.3-20.el8_2.1 | < 0:2.4.0-9.el8_4.2 | < 0:2.2.0-19.el8_1.2
sssd-tools< 0:2.2.3-20.el8_2.1 | < 0:2.4.0-9.el8_4.2 | < 0:2.2.0-19.el8_1.2 | < 0:1.16.5-10.el7_9.10
sssd-tools-debuginfo< 0:2.2.3-20.el8_2.1 | < 0:2.4.0-9.el8_4.2 | < 0:2.2.0-19.el8_1.2
sssd-winbind-idmap< 0:2.2.3-20.el8_2.1 | < 0:2.4.0-9.el8_4.2 | < 0:2.2.0-19.el8_1.2 | < 0:1.16.5-10.el7_9.10
sssd-winbind-idmap-debuginfo< 0:2.2.3-20.el8_2.1 | < 0:2.4.0-9.el8_4.2 | < 0:2.2.0-19.el8_1.2

Show all 74

Suse20 products

sssd&distro=SUSE Enterprise Storage 6< 1.16.1-8.64.1
sssd&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS< 1.16.1-8.64.1
sssd&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS< 1.16.1-8.64.1
sssd&distro=SUSE Linux Enterprise High Performance Computing 15-ESPOS< 1.16.1-8.64.1
sssd&distro=SUSE Linux Enterprise High Performance Computing 15-LTSS< 1.16.1-8.64.1

Show all 20

Fedoraproject2 products

fedoraEOL34
sssd2.6.0

Opensuse2 products

sssd&distro=openSUSE Leap 15.3< 1.16.1-23.11.1
sssd&distro=openSUSE Leap 15.4< 2.5.2-150400.4.5.14

Debian1 product

sssd< 1.15.0-3+deb9u2 | < 2.5.2-1

Mageia1 product

sssd< 2.4.0-1.2.mga8

Ubuntu1 product

sssd< 1.16.1-1ubuntu1.8 | < 2.2.3-3ubuntu0.7 | < 2.4.1-2ubuntu4

7 vendors · 101 products

References

44 links

sssd.io/release-notes/sssd-2.6.0.htmlRelease NotesThird Party Advisory
bugzilla.redhat.com/show_bug.cgi?id=1975142REPORTIssue TrackingPatchThird Party Advisory
lists.debian.org/debian-lts-announce/2023/05/msg00028.htmlMailing ListThird Party Advisory
lists.debian.org/debian-lts-announce/2025/02/msg00008.html
advisories.mageia.org/MGASA-2021-0502.htmlAdvisory
bugs.mageia.org/show_bug.cgi?id=29383REPORT
lists.fedoraproject.org/archives/…WEB
www.suse.com/support/update/announcement/-2021-3185/suse-ru-20213185-1/Advisory
bugzilla.suse.com/1182058REPORT
bugzilla.suse.com/1182637REPORT

Show all 44 references

bugzilla.suse.com/1184289REPORT
bugzilla.suse.com/1187120REPORT
bugzilla.suse.com/1189492REPORT
bugzilla.suse.com/1190021REPORT
www.suse.com/security/cve/CVE-2021-3621WEB
www.suse.com/support/update/announcement/2021/suse-su-20212873-1/Advisory
www.suse.com/support/update/announcement/2021/suse-su-20212941-1/Advisory
bugzilla.suse.com/1183735REPORT
www.suse.com/support/update/announcement/2022/suse-su-20220826-1/Advisory
bugzilla.suse.com/1190775REPORT
www.suse.com/support/update/announcement/2022/suse-su-20221258-1/Advisory
bugzilla.suse.com/1196564REPORT
www.suse.com/support/update/announcement/2022/suse-su-20222763-1/Advisory
bugzilla.suse.com/1195552REPORT
bugzilla.suse.com/1196166REPORT
access.redhat.com/errata/RHSA-2021:3151Advisory
access.redhat.com/security/updates/classification/ARTICLE
security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3151.jsonAdvisory
access.redhat.com/security/cve/CVE-2021-3621REPORT
www.cve.org/CVERecord?id=CVE-2021-3621AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2021-3621Advisory
access.redhat.com/errata/RHSA-2021:3178Advisory
security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3178.jsonAdvisory
access.redhat.com/errata/RHSA-2021:3336Advisory
bugzilla.redhat.com/show_bug.cgi?id=1964415REPORT
bugzilla.redhat.com/show_bug.cgi?id=1968330REPORT
bugzilla.redhat.com/show_bug.cgi?id=1988463REPORT
security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3336.jsonAdvisory
access.redhat.com/errata/RHSA-2021:3365Advisory
security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3365.jsonAdvisory
ubuntu.com/security/CVE-2021-3621REPORT
ubuntu.com/security/notices/USN-5067-1Advisory
security-tracker.debian.org/tracker/CVE-2021-3621Advisory
lists.opensuse.org/archives/…Advisory