Debian Package Tracker

general

source: sssd (main)
version: 2.2.2-1
maintainer: Debian SSSD Team (archive) (DMD)
uploaders: Timo Aaltonen [DMD] – Dominik George [DMD]
arch: any
std-ver: 4.4.0
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 1.11.7-3
o-o-sec: 1.11.7-3+deb8u2
oldstable: 1.15.0-3
stable: 1.16.3-3.1
testing: 2.2.2-1
unstable: 2.2.2-1

versioned links

1.11.7-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.11.7-3+deb8u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.15.0-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.16.3-3.1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.2.2-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libipa-hbac-dev
libipa-hbac0
libnss-sss (1 bugs: 0, 1, 0, 0)
libpam-sss (2 bugs: 0, 2, 0, 0)
libsss-certmap-dev
libsss-certmap0
libsss-idmap-dev
libsss-idmap0
libsss-nss-idmap-dev
libsss-nss-idmap0
libsss-simpleifp-dev
libsss-simpleifp0
libsss-sudo (3 bugs: 0, 3, 0, 0)
libwbclient-sssd
libwbclient-sssd-dev
python3-libipa-hbac
python3-libsss-nss-idmap
python3-sss
sssd (22 bugs: 0, 21, 1, 0)
sssd-ad (1 bugs: 0, 1, 0, 0)
sssd-ad-common
sssd-common (2 bugs: 0, 2, 0, 0)
sssd-dbus
sssd-ipa
sssd-kcm (1 bugs: 0, 1, 0, 0)
sssd-krb5 (1 bugs: 0, 1, 0, 0)
sssd-krb5-common
sssd-ldap (1 bugs: 0, 1, 0, 0)
sssd-proxy
sssd-tools

action needed

A new upstream version is available: 2.2.3 high

A new upstream version 2.2.3 is available, you should consider packaging it.

Created: 2019-12-03 Last update: 2019-12-08 15:07

2 security issues in bullseye high

There are 2 open security issues in bullseye.

2 important issues:

CVE-2019-3811: A vulnerability was found in sssd. If a user was configured with no home directory set, sssd would return '/' (the root directory) instead of '' (the empty string / no home directory). This could impact services that restrict the user's filesystem access to within their home directory through chroot() etc. All versions before 2.1 are vulnerable.
CVE-2018-10852: The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD has too wide permissions, which means that anyone who can send a message using the same raw protocol that sudo and SSSD use can read the sudo rules available for any user. This affects versions of SSSD before 1.16.3.

Please fix them.

Created: 2019-07-07 Last update: 2019-10-21 00:30

2 security issues in sid high

There are 2 open security issues in sid.

2 important issues:

CVE-2019-3811: A vulnerability was found in sssd. If a user was configured with no home directory set, sssd would return '/' (the root directory) instead of '' (the empty string / no home directory). This could impact services that restrict the user's filesystem access to within their home directory through chroot() etc. All versions before 2.1 are vulnerable.
CVE-2018-10852: The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD has too wide permissions, which means that anyone who can send a message using the same raw protocol that sudo and SSSD use can read the sudo rules available for any user. This affects versions of SSSD before 1.16.3.

Please fix them.

Created: 2018-06-26 Last update: 2019-10-21 00:30

5 security issues in stretch high

There are 5 open security issues in stretch.

1 important issue:

CVE-2017-12173: It was found that sssd's sysdb_search_user_by_upn_res() function before 1.16.0 did not sanitize requests when querying its local cache and was vulnerable to injection. In a centralized login environment, if a password hash was locally cached for a given user, an authenticated attacker could use this flaw to retrieve it.

4 issues skipped by the security teams:

CVE-2019-3811: A vulnerability was found in sssd. If a user was configured with no home directory set, sssd would return '/' (the root directory) instead of '' (the empty string / no home directory). This could impact services that restrict the user's filesystem access to within their home directory through chroot() etc. All versions before 2.1 are vulnerable.
CVE-2018-10852: The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD has too wide permissions, which means that anyone who can send a message using the same raw protocol that sudo and SSSD use can read the sudo rules available for any user. This affects versions of SSSD before 1.16.3.
CVE-2018-16838: A flaw was found in sssd Group Policy Objects implementation. When the GPO is not readable by SSSD due to a too strict permission settings on the server side, SSSD will allow all authenticated users to login instead of denying access.
CVE-2018-16883: sssd versions from 1.13.0 to before 2.0.0 did not properly restrict access to the infopipe according to the "allowed_uids" configuration parameter. If sensitive information were stored in the user directory, this could be inadvertently disclosed to local attackers.

Please fix them.

Created: 2017-10-05 Last update: 2019-10-21 00:30

Depends on packages which need a new maintainer normal

The packages that sssd depends on which need a new maintainer are:

docbook-xml (#802368)
- Build-Depends: docbook-xml
docbook-xsl (#802370)
- Build-Depends: docbook-xsl
libnfsidmap (#925022)
- Build-Depends: libnfsidmap-dev
- Depends: libnfsidmap2

Created: 2019-11-22 Last update: 2019-12-08 19:39

3 bugs tagged patch in the BTS normal

The BTS contains patches fixing 3 bugs, consider including or untagging them.

Created: 2019-04-01 Last update: 2019-12-08 19:22

lintian reports 68 warnings normal

Lintian reports 68 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2019-08-28 Last update: 2019-10-20 03:50

4 ignored security issues in buster low

There are 4 open security issues in buster.

4 issues skipped by the security teams:

CVE-2019-3811: A vulnerability was found in sssd. If a user was configured with no home directory set, sssd would return '/' (the root directory) instead of '' (the empty string / no home directory). This could impact services that restrict the user's filesystem access to within their home directory through chroot() etc. All versions before 2.1 are vulnerable.
CVE-2018-10852: The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD has too wide permissions, which means that anyone who can send a message using the same raw protocol that sudo and SSSD use can read the sudo rules available for any user. This affects versions of SSSD before 1.16.3.
CVE-2018-16838: A flaw was found in sssd Group Policy Objects implementation. When the GPO is not readable by SSSD due to a too strict permission settings on the server side, SSSD will allow all authenticated users to login instead of denying access.
CVE-2018-16883: sssd versions from 1.13.0 to before 2.0.0 did not properly restrict access to the infopipe according to the "allowed_uids" configuration parameter. If sensitive information were stored in the user directory, this could be inadvertently disclosed to local attackers.

Please fix them.

Created: 2018-06-26 Last update: 2019-10-21 00:30

1 ignored security issue in jessie low

There is 1 open security issue in jessie.

1 issue skipped by the security teams:

CVE-2015-5292: Memory leak in the Privilege Attribute Certificate (PAC) responder plugin (sssd_pac_plugin.so) in System Security Services Daemon (SSSD) 1.10 before 1.13.1 allows remote authenticated users to cause a denial of service (memory consumption) via a large number of logins that trigger parsing of PAC blobs during Kerberos authentication.

Please fix it.

Created: 2015-10-05 Last update: 2019-10-21 00:30

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.4.1 instead of 4.4.0).

Created: 2019-09-29 Last update: 2019-09-29 23:40

news

[rss feed]

[2019-10-07] sssd 2.2.2-1 MIGRATED to testing (Debian testing watch)
[2019-09-18] Accepted sssd 2.2.2-1 (source) into unstable (Timo Aaltonen)
[2019-07-23] sssd 2.2.0-4 MIGRATED to testing (Debian testing watch)
[2019-07-19] Accepted sssd 2.2.0-4 (source) into unstable (Timo Aaltonen)
[2019-07-12] Accepted sssd 2.2.0-3 (source) into unstable (Timo Aaltonen)
[2019-07-10] Accepted sssd 2.2.0-2 (source) into unstable (Timo Aaltonen)
[2019-07-10] Accepted sssd 2.2.0-1 (source) into unstable (Timo Aaltonen)
[2019-05-27] Accepted sssd 2.1.0-1 (source) into experimental (Timo Aaltonen)
[2019-04-03] Accepted sssd 1.16.4-1~exp1 (source) into experimental (Timo Aaltonen)
[2019-03-06] sssd 1.16.3-3.1 MIGRATED to testing (Debian testing watch)
[2019-02-24] Accepted sssd 1.16.3-3.1 (source amd64) into unstable (Dominik George)
[2019-01-17] Accepted sssd 1.11.7-3+deb8u2 (source amd64) into oldstable (Mike Gabriel)
[2018-12-19] sssd 1.16.3-3 MIGRATED to testing (Debian testing watch)
[2018-12-02] Accepted sssd 1.16.3-3 (source) into unstable (Timo Aaltonen)
[2018-11-06] Accepted sssd 1.16.3-2 (source) into unstable (Timo Aaltonen)
[2018-08-27] sssd 1.16.3-1 MIGRATED to testing (Debian testing watch)
[2018-08-22] Accepted sssd 1.16.3-1 (source) into unstable (Timo Aaltonen)
[2018-07-16] Accepted sssd 1.11.7-3+deb8u1 (source) into oldstable (Brian May)
[2018-07-02] sssd 1.16.2-1 MIGRATED to testing (Debian testing watch)
[2018-06-27] Accepted sssd 1.16.2-1 (source) into unstable (Timo Aaltonen)
[2018-03-18] sssd 1.16.1-1 MIGRATED to testing (Debian testing watch)
[2018-03-13] Accepted sssd 1.16.1-1 (source) into unstable (Timo Aaltonen)
[2018-01-31] sssd 1.16.0-5 MIGRATED to testing (Debian testing watch)
[2018-01-26] Accepted sssd 1.16.0-5 (source) into unstable (Timo Aaltonen)
[2018-01-26] Accepted sssd 1.16.0-4 (source) into unstable (Timo Aaltonen)
[2018-01-04] Accepted sssd 1.16.0-3 (source) into unstable (Timo Aaltonen)
[2017-12-31] sssd 1.16.0-2 MIGRATED to testing (Debian testing watch)
[2017-12-25] Accepted sssd 1.16.0-2 (source) into unstable (Timo Aaltonen)
[2017-12-25] sssd 1.16.0-1 MIGRATED to testing (Debian testing watch)
[2017-12-20] Accepted sssd 1.16.0-1 (source) into unstable (Timo Aaltonen)

bugs [bug history graph]

all: 39
RC: 0
I&N: 37
M&W: 2
F&P: 0
patch: 3

links

homepage
lintian (0, 68)
buildd: logs, clang, reproducibility, cross
popcon
browse source code
edit tags
security tracker
screenshots
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 2.2.2-1
19 bugs