Approved changes feed: RSS · Atom

cpe:2.3:a:fedoraproject:sssd:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorFedoraproject (edb280c5-6017-5a8b-8553-28ce724531a7)
ProductSssd (b7a5aa9a-3cdc-5470-8c42-ec356f4f4e7e)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from purl2cpe mapping

PURL mappings

PURLSourceLast updated
pkg:deb/debian/sssd purl2cpe 2026-06-01 10:15:31.032021
pkg:deb/ubuntu/sssd purl2cpe 2026-06-01 10:15:31.032024
pkg:github/sssd/sssd purl2cpe 2026-06-01 10:15:31.032027
pkg:rpm/fedora/sssd purl2cpe 2026-06-01 10:15:31.032030
pkg:rpm/opensuse/sssd purl2cpe 2026-06-01 10:15:31.032032

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2023-3758 vulnerable 2026-06-08 06:09:40.433743 Sssd: race condition during authorization leads to gpo policies functioning inconsistently
HIGH (7.1)
A race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated users. This may lead to improper authorization issues, granting or denying access to resources inappropriately.
Published: 2024-04-18T19:06:44.216Z
Updated: 2025-11-06T22:57:03.881Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2022-4254 vulnerable 2026-06-08 05:51:37.050774 Details available
sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters
Published: 2023-02-01T00:00:00.000Z
Updated: 2025-03-27T14:42:34.058Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2019-3811 vulnerable 2026-06-08 05:13:56.079642 Details available
MEDIUM (4.1)
A vulnerability was found in sssd. If a user was configured with no home directory set, sssd would return '/' (the root directory) instead of '' (the empty string / no home directory). This could impact services that restrict the user's filesystem access to within their home directory through chroot() etc. All versions before 2.1 are vulnerable.
Published: 2019-01-15T15:00:00.000Z
Updated: 2025-02-13T16:27:24.771Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2018-16883 vulnerable 2026-06-08 05:11:05.725335 Details available
LOW (2.5)
sssd versions from 1.13.0 to before 2.0.0 did not properly restrict access to the infopipe according to the "allowed_uids" configuration parameter. If sensitive information were stored in the user directory, this could be inadvertently disclosed to local attackers.
Published: 2018-12-19T14:00:00.000Z
Updated: 2024-08-05T10:32:54.202Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2018-10852 vulnerable 2026-06-08 05:10:37.189361 Details available
LOW (3.8)
The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD has too wide permissions, which means that anyone who can send a message using the same raw protocol that sudo and SSSD use can read the sudo rules available for any user. This affects versions of SSSD before 1.16.3.
Published: 2018-06-26T14:00:00.000Z
Updated: 2024-08-05T07:46:47.244Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2017-12173 vulnerable 2026-06-08 05:08:45.486339 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2013-0220 vulnerable 2026-06-08 05:03:46.166722 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2013-0219 vulnerable 2026-06-08 05:03:46.123422 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2010-0014 vulnerable 2026-06-08 04:51:52.324011 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.