Detections
Analytics
Rocky Linux 10 [CIQ] Security Update: libipa_hbac / libipa_hbac-debuginfo / libsss_autofs / etc Multiple Vulnerabilities (crlsa-2026_97077)
medium Nessus Plugin ID 381050
Synopsis
The Rocky Linux host is missing one or more security updates.Description
The Rocky Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_97077 advisory.* sssd: out-of-bounds read in the sssd (CVE-2026-6245)
* sssd: Use-after-free crash in SSSD' 'sssd_pam' process (CVE-2026-12610)
Bug Fix(es) and Enhancement(s):
* Concurrent child processes trigger unnecessarily backtrace (JIRA:Rocky Linux-108116)
* Performance impact with enumerate in SSSD > 2.7.3 (JIRA:Rocky Linux-109754)
* Man page update: man sssd_krb5_localauth_plugin ? Missing disable = an2ln (JIRA:Rocky Linux-123943)
* [RFE] SSSD PAM: Support Microsoft AD PKINIT authentication indicator (ms-pkca) for pam_gssapi_indicators_map (JIRA:Rocky Linux-138905)
* Poor performance of `BE_REQ_INITGROUPS` handling by 'sssd_be' (LDAP RFC2307, no nested groups) (JIRA:Rocky Linux-142964)
* SSSD needs to add Plasma Login Manager to the PAM services whitelist for the AD provider (JIRA:Rocky Linux-154156)
* Detect foreign security principals in AD group members and silently ignore them (JIRA:Rocky Linux-5049)
* [RfE] sssd_oidc: IdP client using TLS Certificate for authentication (JIRA:Rocky Linux-83540)
* SSSD kerberos plugins export symbols which clash (JIRA:Rocky Linux-151491)
* sssd_be segfaults with option enumerate = true with `id_provider=ldap` (JIRA:Rocky Linux-153036)
* SSSD: LDAP backend ('sssd_be') initialization fails if DNS in unresponsive (JIRA:Rocky Linux-172303)
* SSSD 2.13 doesn't work in offline mode, generates plenty of Permission denied errors (JIRA:Rocky Linux-173660)
* [Regression] Cannot log in to FreeIPA account with password immediately after boot (JIRA:Rocky Linux-173663)
* 'sssctl analyze --help' shows incorrect command in usage field (JIRA:Rocky Linux-178180)
* Rebase SSSD for Rocky Linux 10.3 (JIRA:Rocky Linux-183331)
* Smart card reader with pinpad fails C_Login. (CKF_PROTECTED_AUTHENTICATION_PATH not handled correctly) (JIRA:Rocky Linux-5054)
* 'sssctl config-check' does not work correctly for Accessing AD with a MSA (JIRA:Rocky Linux-111571)
* Regression in IPA + Idp authentication with keycloak (JIRA:Rocky Linux-185008)
Tenable has extracted the preceding description block directly from the CIQ security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Update the affected packages based on the guidance in CIQ advisory crlsa-2026_97077.See Also
https://access.redhat.com/errata/RHSA-2026:97077
https://bugzilla.redhat.com/show_bug.cgi?id=2457954
https://bugzilla.redhat.com/show_bug.cgi?id=2490288
https://errata.build.resf.org/RLSA-2026:97077
Plugin Details
Severity: Medium
ID: 381050
File Name: ciq_rocky_linux_10_crlsa-2026_97077.nasl
Version: 1.1
Type: Local
Published: 11/14/2026
Updated: 11/14/2026
Supported Sensors: Continuous Assessment, Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 4.9
Percentile: 58.14
Vendor
Vendor Severity: Unknown
CVSS v2
Risk Factor: Medium
Base Score: 5.9
Temporal Score: 4.4
Vector: CVSS2#AV:L/AC:H/Au:M/C:C/I:C/A:C
CVSS Score Source: CVE-2026-12610
CVSS v3
Risk Factor: Medium
Base Score: 6.4
Temporal Score: 5.6
Vector: CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Required KB Items: Host/OS/extended-third-party, Host/local_checks_enabled, Host/RockyLinux/release, Host/RockyLinux/rpm-list, Host/cpu
Exploit Ease: No known exploits are available
Patch Publication Date: 11/13/2026
Vulnerability Publication Date: 4/15/2026
Reference Information
CVE: CVE-2026-12610, CVE-2026-6245