sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters (CVE-2022-4254)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to the versions of the sssd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters (CVE-2022-4254)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-6156-1 advisory.

    It was discovered that SSSD incorrrectly sanitized certificate data used in LDAP filters. When using this     issue in combination with FreeIPA, a remote attacker could possibly use this issue to escalate privileges.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the sssd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters (CVE-2022-4254)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3436 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3436-2                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Guilhem Moulin     May 31, 2023                                  https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : sssd     Version        : 1.16.3-3.2+deb10u2

    sssd 1.16.3-3.2+deb10u1 (DLA 3436-1) had a broken upgrade path from     version 1.16.3-3.2.

    One could upgrade sssd-common to 1.16.3-3.2+deb10u1 while leaving     libsss-certmap0 at 1.16.3-3.2; the version mismatch broke SSSD as the     the fix for CVE-2022-4254 introduces new symbols which are used in     sssd-common's sssd_pam.

    For Debian 10 buster, this problem has been fixed in version     1.16.3-3.2+deb10u2.  This version differs from 1.16.3-3.2+deb10u1 only     in package metadata.  (Bumping the minimum version for libsss-certmap0     in sssd-common's Depends: field ensures a safe upgrade path.)

    We recommend that you upgrade your sssd packages.

    For the detailed security status of sssd please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/sssd

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of sssd installed on the remote host is prior to 1.16.4-21.27. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1723 advisory.

    A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-     fetch and cache-expire subcommands. This flaw allows an attacker to trick the root user into running a     specially crafted sssctl command, such as via sudo, to gain root access. The highest threat from this     vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2021-3621)

    A vulnerability was found in SSSD, in the libsss_certmap functionality. PKINIT enables a client to     authenticate to the KDC using an X.509 certificate and the corresponding private key, rather than a     passphrase or keytab. FreeIPA uses mapping rules to map a certificate presented during a PKINIT     authentication request to the corresponding principal. The mapping filter is vulnerable to LDAP filter     injection. The search result can be influenced by values in the certificate, which may be attacker     controlled. In the most extreme case, an attacker could gain control of the admin account, leading to full     domain takeover. (CVE-2022-4254)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of sssd installed on the remote host is prior to 1.16.5-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1995 advisory.

    A vulnerability was found in SSSD, in the libsss_certmap functionality. PKINIT enables a client to     authenticate to the KDC using an X.509 certificate and the corresponding private key, rather than a     passphrase or keytab. FreeIPA uses mapping rules to map a certificate presented during a PKINIT     authentication request to the corresponding principal. The mapping filter is vulnerable to LDAP filter     injection. The search result can be influenced by values in the certificate, which may be attacker     controlled. In the most extreme case, an attacker could gain control of the admin account, leading to full     domain takeover. (CVE-2022-4254)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:0292-1 advisory.

  - sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters (CVE-2022-4254)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:0300-1 advisory.

  - sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters (CVE-2022-4254)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:0301-1 advisory.

  - sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters (CVE-2022-4254)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:0403 advisory.

  - sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters (CVE-2022-4254)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:0204-1 advisory.

  - sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters (CVE-2022-4254)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:0200-1 advisory.

  - sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters (CVE-2022-4254)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Scientific Linux 7 host has packages installed that are affected by a vulnerability as referenced in the SLSA-2023:0403-1 advisory.

  - sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters (CVE-2022-4254)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:0442 advisory.

    The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote     directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the     Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to     connect to multiple different account sources.

    Security Fix(es):

    * sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters (CVE-2022-4254)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:0403 advisory.

    The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote     directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the     Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to     connect to multiple different account sources.

    Security Fix(es):

    * sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters (CVE-2022-4254)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * smartcards: special characters must be escaped when building search filter (BZ#2149703)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-0403 advisory.

    [1.16.5-10.0.3]
    - Revert Redhat's change of disallowing duplicated incomplete gid       when 'id_provider=ldap' is used, which caused regression in AD       environment. [Orabug: 29286774] [Doc ID 2605732.1]

    [1.16.5-10.15]
    - Resolves: rhbz#2149703 - smartcards: special characters must be escaped when building search filter     [rhel-7.9.z]
    - Resolves: rhbz#2149902 - EMBARGOED CVE-2022-4254 sssd: libsss_certmap fails to sanitise certificate data     used in LDAP filters [rhel-7.9.z]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:0397 advisory.

    The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote     directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the     Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to     connect to multiple different account sources.

    Security Fix(es):

    * sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters (CVE-2022-4254)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
256914	Linux Distros Unpatched Vulnerability : CVE-2022-4254	Nessus	Misc.	high
178997	EulerOS Virtualization 2.10.1 : sssd (EulerOS-SA-2023-2456)	Nessus	Huawei Local Security Checks	high
178993	EulerOS Virtualization 2.10.0 : sssd (EulerOS-SA-2023-2481)	Nessus	Huawei Local Security Checks	high
178877	EulerOS Virtualization 3.0.6.6 : sssd (EulerOS-SA-2023-2438)	Nessus	Huawei Local Security Checks	high
177154	EulerOS Virtualization 3.0.6.0 : sssd (EulerOS-SA-2023-2249)	Nessus	Huawei Local Security Checks	high
177114	Ubuntu 20.04 LTS : SSSD vulnerability (USN-6156-1)	Nessus	Ubuntu Local Security Checks	high
177040	EulerOS 2.0 SP5 : sssd (EulerOS-SA-2023-2172)	Nessus	Huawei Local Security Checks	high
176599	EulerOS Virtualization 2.9.0 : sssd (EulerOS-SA-2023-2026)	Nessus	Huawei Local Security Checks	high
176580	EulerOS Virtualization 2.9.1 : sssd (EulerOS-SA-2023-2005)	Nessus	Huawei Local Security Checks	high
176457	Debian dla-3436 : libipa-hbac-dev - security update	Nessus	Debian Local Security Checks	high
176033	EulerOS 2.0 SP10 : sssd (EulerOS-SA-2023-1985)	Nessus	Huawei Local Security Checks	high
176007	EulerOS 2.0 SP10 : sssd (EulerOS-SA-2023-1963)	Nessus	Huawei Local Security Checks	high
175518	EulerOS 2.0 SP9 : sssd (EulerOS-SA-2023-1854)	Nessus	Huawei Local Security Checks	high
175494	EulerOS 2.0 SP9 : sssd (EulerOS-SA-2023-1879)	Nessus	Huawei Local Security Checks	high
174212	EulerOS 2.0 SP8 : sssd (EulerOS-SA-2023-1610)	Nessus	Huawei Local Security Checks	high
173941	Amazon Linux AMI : sssd (ALAS-2023-1723)	Nessus	Amazon Linux Local Security Checks	high
173238	Amazon Linux 2 : sssd (ALAS-2023-1995)	Nessus	Amazon Linux Local Security Checks	high
171192	SUSE SLES15 Security Update : sssd (SUSE-SU-2023:0292-1)	Nessus	SuSE Local Security Checks	high
171183	SUSE SLES15 Security Update : sssd (SUSE-SU-2023:0300-1)	Nessus	SuSE Local Security Checks	high
171138	SUSE SLES12 Security Update : sssd (SUSE-SU-2023:0301-1)	Nessus	SuSE Local Security Checks	high
170864	CentOS 7 : sssd (RHSA-2023:0403)	Nessus	CentOS Local Security Checks	high
170745	SUSE SLES15 Security Update : sssd (SUSE-SU-2023:0204-1)	Nessus	SuSE Local Security Checks	high
170744	SUSE SLES12 Security Update : sssd (SUSE-SU-2023:0200-1)	Nessus	SuSE Local Security Checks	high
170642	Scientific Linux Security Update : sssd on SL7.x i686/x86_64 (2023:0403)	Nessus	Scientific Linux Local Security Checks	high
170535	RHEL 8 : sssd (RHSA-2023:0442)	Nessus	Red Hat Local Security Checks	high
170522	RHEL 7 : sssd (RHSA-2023:0403)	Nessus	Red Hat Local Security Checks	high
170521	Oracle Linux 7 : sssd (ELSA-2023-0403)	Nessus	Oracle Linux Local Security Checks	high
170479	RHEL 8 : sssd (RHSA-2023:0397)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2022-4254

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high