A race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated users. This may lead to improper authorization issues, granting or denying access to resources inappropriately.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - sssd: shell command injection in sssctl (CVE-2021-3621)

  - The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD has too wide     permissions, which means that anyone who can send a message using the same raw protocol that sudo and SSSD     use can read the sudo rules available for any user. This affects versions of SSSD before 1.16.3.
    (CVE-2018-10852)

  - sssd versions from 1.13.0 to before 2.0.0 did not properly restrict access to the infopipe according to     the allowed_uids configuration parameter. If sensitive information were stored in the user directory,     this could be inadvertently disclosed to local attackers. (CVE-2018-16883)

  - A vulnerability was found in sssd. If a user was configured with no home directory set, sssd would return     '/' (the root directory) instead of '' (the empty string / no home directory). This could impact services     that restrict the user's filesystem access to within their home directory through chroot() etc. All     versions before 2.1 are vulnerable. (CVE-2019-3811)

  - A race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated     users. This may lead to improper authorization issues, granting or denying access to resources     inappropriately. (CVE-2023-3758)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - sssd: Information leak in infopipe due to an improper uid restriction (CVE-2018-16883)

  - A race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated     users. This may lead to improper authorization issues, granting or denying access to resources     inappropriately. (CVE-2023-3758)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:1579-1 advisory.

  - A race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated     users. This may lead to improper authorization issues, granting or denying access to resources     inappropriately. (CVE-2023-3758)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:1563-1 advisory.

  - A race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated     users. This may lead to improper authorization issues, granting or denying access to resources     inappropriately. (CVE-2023-3758)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:1578-1 advisory.

  - A race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated     users. This may lead to improper authorization issues, granting or denying access to resources     inappropriately. (CVE-2023-3758)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-2571 advisory.

  - A race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated     users. This may lead to improper authorization issues, granting or denying access to resources     inappropriately. (CVE-2023-3758)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:1549-1 advisory.

  - A race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated     users. This may lead to improper authorization issues, granting or denying access to resources     inappropriately. (CVE-2023-3758)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-78240de990 advisory.

  - A race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated     users. This may lead to improper authorization issues, granting or denying access to resources     inappropriately. (CVE-2023-3758)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-44602bead8 advisory.

  - A race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated     users. This may lead to improper authorization issues, granting or denying access to resources     inappropriately. (CVE-2023-3758)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:2571 advisory.

  - A race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated     users. This may lead to improper authorization issues, granting or denying access to resources     inappropriately. (CVE-2023-3758)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-3798818c82 advisory.

  - A race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated     users. This may lead to improper authorization issues, granting or denying access to resources     inappropriately. (CVE-2023-3758)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:1920 advisory.

  - sssd: Race condition during authorization leads to GPO policies functioning inconsistently (CVE-2023-3758)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:1921 advisory.

  - sssd: Race condition during authorization leads to GPO policies functioning inconsistently (CVE-2023-3758)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:1919 advisory.

  - sssd: Race condition during authorization leads to GPO policies functioning inconsistently (CVE-2023-3758)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:1922 advisory.

  - sssd: Race condition during authorization leads to GPO policies functioning inconsistently (CVE-2023-3758)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
196834	RHEL 6 : sssd (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
196821	RHEL 7 : sssd (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
195295	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : sssd (SUSE-SU-2024:1579-1)	Nessus	SuSE Local Security Checks	high
195292	SUSE SLES15 Security Update : sssd (SUSE-SU-2024:1563-1)	Nessus	SuSE Local Security Checks	high
195288	SUSE SLES15 Security Update : sssd (SUSE-SU-2024:1578-1)	Nessus	SuSE Local Security Checks	high
195159	Oracle Linux 9 : sssd (ELSA-2024-2571)	Nessus	Oracle Linux Local Security Checks	high
195150	SUSE SLES15 Security Update : sssd (SUSE-SU-2024:1549-1)	Nessus	SuSE Local Security Checks	high
195145	Fedora 39 : sssd (2024-78240de990)	Nessus	Fedora Local Security Checks	high
195144	Fedora 38 : sssd (2024-44602bead8)	Nessus	Fedora Local Security Checks	high
194844	RHEL 9 : sssd (RHSA-2024:2571)	Nessus	Red Hat Local Security Checks	high
194617	Fedora 40 : sssd (2024-3798818c82)	Nessus	Fedora Local Security Checks	high
193509	RHEL 9 : sssd (RHSA-2024:1920)	Nessus	Red Hat Local Security Checks	high
193507	RHEL 8 : sssd (RHSA-2024:1921)	Nessus	Red Hat Local Security Checks	high
193505	RHEL 9 : sssd (RHSA-2024:1919)	Nessus	Red Hat Local Security Checks	high
193503	RHEL 8 : sssd (RHSA-2024:1922)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2023-3758

high

Tenable Plugins

high

medium

high

high

high

high

high

high

high

high

high

high

high

high

high