CVE-2023-3758

NameCVE-2023-3758
DescriptionA race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated users. This may lead to improper authorization issues, granting or denying access to resources inappropriately.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-4047-1
Debian Bugs1070369

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
sssd (PTS)bullseye2.4.1-2vulnerable
bullseye (security)2.4.1-2+deb11u1fixed
bookworm2.8.2-4+deb12u1fixed
sid, trixie2.10.1-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
sssdsourcebullseye2.4.1-2+deb11u1DLA-4047-1
sssdsourcebookworm2.8.2-4+deb12u1
sssdsource(unstable)2.9.5-11070369

Notes

[buster] - sssd <postponed> (Minor issue)
https://bugzilla.redhat.com/show_bug.cgi?id=2223762
https://github.com/SSSD/sssd/pull/7302
https://github.com/SSSD/sssd/commit/d7db7971682da2dbf7642ac94940d6b0577ec35a (master)
https://github.com/SSSD/sssd/commit/e1bfbc2493c4194988acc3b2413df3dde0735ae3 (sssd-2-9 branch)
https://github.com/SSSD/sssd/commit/f4ebe1408e0bc67abfbfb5f0ca2ea13803b36726 (sssd-2-8-branch)

Search for package or bug name: Reporting problems