-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Fri, 13 Nov 2026 09:27:34 +0100 Source: sssd Architecture: source Version: 2.13.1-5 Distribution: unstable Urgency: medium Maintainer: Debian SSSD Team <sssd@packages.debian.org> Changed-By: Mike Gabriel <mike.gabriel@das-netzwerkteam.de> Closes: 1148324 1148325 1148326 1148452 1148827 1150199 1150238 Changes: sssd (2.13.1-5) unstable; urgency=medium . * debian/patches: - CVE-2026-80048: Fix flaw in sssd-kcm where a user with access to the `sssd-kcm` UNIX socket has been able to cause the system to preallocate significant memory by sending a large request length header, leading to memory exhaustion, and thus ending in a DoS. (Closes: #1150238). - CVE-2026-87853: IDP: fix user matching in `eval_access_token_buf()`. Make sure it is exact, not merely a prefix match. - CVE-2026-88252: Fix flaw in sssd where a local user has been able to cause a Denial of Service (DoS) by exhausting the responder service's available file descriptors (system handles used for open connections). (Closes: #1150238) - CVE-2026-90462: LDAP: fix fail-open in ppolicy access check on zero results. Don't incorrectly return success and cache an allow decision, permitting continued authorization for a deleted or deprovisioned user. (Closes: #1148827) - CVE-2026-90994: Fix a flaw in sssd's PAM responder's protocol v1 parser, where a local client with access to the PAM responder's UNIX socket as been able to send an empty or truncated PAM request body, triggering an out-of-bounds read, leading to a denial of service. (Closes: #1148324) CVE-2026-90996: Fix a flaw in sssd where a local unprivileges user has been able to send a specially crafted request with a zero-length body to the Network Security Service (NSS) responder. This could have lead to a denial-of-service condition, causing the NSS responder to become unstable or terminate. (Closes: #1148326) - CVE-2026-90463: Fix input validation vulnerability in sssd's NSS responder: The vulnerability has allowed a local attacker to cause an out-of-bounds read by sending specially crafted service lookup requests to the NSS responder's UNIX socket, leading to crashes of the NSS responder process. (Closes: #1148452) - CVE-2026-90995: PAM: avoid NULL deref when service item is missing. (Closes: #1148325). - CVE-2026-104031: autofs: free per-request context on successful replies. (Closes: #1150238). - CVE-2026-104032: autofs: add 'allowed_uids' option to the autofs responder. Prevent unprivileged local users from repeatedly requesting master automount map updates through the autofs responder due to missing authorization checks. (Closes: #1150238). - CVE-2026-104033: Treat shadowExpire=0 correctly. shadowExpire can be set to 0, representing the beginning of the Unix epoch. An account with shadowExpire set to 0 should be treated as expired. (Closes: #1150238). - CVE-2026-104036: nfs idmap: error out if buffer is too small. Prevent denial-of-service caused by out-of-bounds writes when requesting identity lookups that resolve to oversized cached entries. (Closes: #1150238). - CVE-2026-104038: certmap: check that SID exists in certificate. Prevent from attachers being able to cause denial-of-services by certmap: check that SID exists in certificate. (Closes: #1150238). - CVE-2026-104039: PAM: clear state pointer before freeing state itself. When handling Generic Security Services Application Programming Interface (GSSAPI) authentication in the Pluggable Authentication Module (PAM) responder, cached connection state was freed upon completion without clearing the reference pointer. This could have lead to attackers being able to exploit this by sending an additional request over the same connection, causing the service to access invalid memory and unexpectedly terminate. (Closes: #1150238). - CVE-2026-104042: pam: Guard against zero-length string auth tokens. Prevent crash in PAM responder by input validation when (crafted) Pluggable Authentication Module (PAM) requests containing a zero-length authentication token gets sent to the responder socket. (Closes: #1150238). - CVE-2026-104043: nss: guard against length underflow in packet. Prevent from out-of-bounds memory read during packet parsing, crashing the responder process and resulting in a Denial of Service (DoS), in case a local attacker with access to the Name Service Switch (NSS) responder UNIX socket triggers an integer underflow by sending a specially crafted request with an undersized packet header. (Closes: #1150238). CVE-2026-104044: pam: prevent null dereference in kerberos passkey flow. Prevent local attackers from being able to trigger a Denial of Service (DoS) by sending a specially crafted Pluggable Authentication Module (PAM) request when passkey authentication is enabled. The additional patch CVE-2026-104044-pre.diff fixes potential memory leaks and is required for CVE-2026-104044.diff to apply cleanly. (Closes: #1150238). - CVE-2026-104045: autofs: avoid leaked enumeration contexts after map. By repeatedly sending concurrent map enumeration and invalidation requests, an attacker has been able to cause memory to leak, leading to excessive memory consumption that could disrupt or crash the autofs service. (Closes: #1150238). - CVE-2026-104046: IDP: Clean old items from open_request_table. When Identity Provider (IdP) authentication had been enabled, pre-authentication requests retained state in memory without being cleared or timed out. A local attacker could have repeatedly initiated authentication flows without completing them, causing unbounded memory consumption. This memory exhaustion could have lead to a Denial of Service (DoS) by degrading or terminating SSSD authentication services. (Closes: #1150238). - CVE-2026-104047: oidc_child: escape single quotes in Entra ID OData filters. When configured to use Microsoft Entra ID, search inputs have not been properly sanitized before being incorporated into directory query filters. A local user has been able exploit this vulnerability by submitting a crafted lookup request, manipulating the query logic to cause unauthorized information disclosure from the directory. (Closes: #1150238). - CVE-2026-104048: ipa: compare users with domain awareness against HBAC rules. In trust-enabled identity management environments, SSSD evaluates Host-Based Access Control (HBAC) rules by stripping domain qualifiers and comparing only short usernames. An authenticated user in a trusted domain who shares the same username as an authorized local account has been able to bypass access policies and gain unauthorized access to protected services or hosts. (Closes: #1150238). * - CVE-2026-104041_NSS-Add-options-to-exclude-UID-and-GID.diff: NSS: Add options to exclude UID and GID (cherry-picked, in order to let patches mitigating CVE-104041-{1,2}.diff apply cleanly). Abstract: :feature: UIDs and GIDs mentioned in the new options filter_uids and filter_gids will make SSSD avoid the LDAP search and just say that they don't exist. They are comma-separated lists of simple values or ranges: filter_uids = 0-999, 1234, 2000-2099 - CVE-2026-104041: negcache: limit max mem size consumed by negative. cache. Negative cache did not limit the total number of stored entries, so far, and only removed expired records when an existing key was rechecked, the cache could grow without bound. (Closes: #1150238). - CVE-2026-92821: ldap: pwd_expire_policy_warn does not overwrite errors Make sure the 'pwd_expire_policy_warn' access check does not overwrite any access denied or other errors. (Closes: #1150199). Checksums-Sha1: 79bfe9a7619c697bb7e5fbfa86c19e74db14129e 5253 sssd_2.13.1-5.dsc cf3b0a8608b29e342e4ac56b029d2d0fd89a88f7 88944 sssd_2.13.1-5.debian.tar.xz 317eb3a43a94975a59ec4ee613088f9e4ce7b61d 12664 sssd_2.13.1-5_source.buildinfo Checksums-Sha256: 157c7cb33fdb266615b8cd6e765802cb72eb32f7b4cab42536da6e953728c7cf 5253 sssd_2.13.1-5.dsc 950ad46d023264e69e48df42d4bc8cc51859a6dbdbb5e8cbdbe1b1664d34f0ba 88944 sssd_2.13.1-5.debian.tar.xz 98d38cd7a8394a698fd3f10d5ecf924bcb87c244dbdd97facdf32eb067ef47f5 12664 sssd_2.13.1-5_source.buildinfo Files: daae5ac049f15cd32a6a34c3b8571aa8 5253 utils optional sssd_2.13.1-5.dsc af300714812caa63e9d6ac7932f22112 88944 utils optional sssd_2.13.1-5.debian.tar.xz 4e7c6612cce7f8ccde418f25261bb50a 12664 utils optional sssd_2.13.1-5_source.buildinfo -----BEGIN PGP SIGNATURE----- iQJVBAEBCgA/FiEEm/uu6GwKpf+/IgeCmvRrMCV3GzEFAmr2yn4hHG1pa2UuZ2Fi cmllbEBkYXMtbmV0endlcmt0ZWFtLmRlAAoJEJr0azAldxsxl2cP/iC3x+/tmttA H/fhOcrUNNxJMgPnXk7ISKfLb25+AJE3nHo0hvreNsXkOsP6948uR48iNpYjDsp9 q3bKcuskpgs6kqFDuRMcA74QsMIBeq0om3ll5MvAxrNjWTjT5gxvhthmkRF2WyTA sJRl5rjwYBlXiOxxcEGolUp3kjG+meQUziE8GYMeNCwLeTcGfC3xk4qWSX5kFegD qgSUj186eQiIzr6pSR9oAoEa1eHxgAra2SGCJox4fDIlR6yNPWX1V45KewQsaeYG c6fKedzWrxC/nhO+C94yszJwnv3G9cOoLuQFYTE5YX6m+bCmU+nVYpkaugSHGAHB FJzor6k2MgSUGVnk1K3wlxooEbdP+pEe7DRkI29rgaH4Zl/RpFpVkLS5+5bYf5Hd eRf4J6iRJEIcqyww6D7kMTvSl+2bLFarZJupsNYXGMm3F0gtmJQYVm4k+PNnCsAw TlvFV36OXnClHszXB/qFeTVvIMEUgSXGMYBHYtnbmPskZRn1tRbIOhkdj6Pnnf+M LYT1xLtPlvo84grAyWq6erDKfBUwGiGJ5mMvMuFPtMi+JY7RZJv5EcZ3GVBlek/c 78y1wDgq7GZEey6xTvmZFEcmPzXOQR9hxOk3zwDSfkkZombBL7gDdYcBDXW088NE dfqc8Mqnn0z6k/xtusyh7dxQCUIrGBwp =7AaA -----END PGP SIGNATURE-----
