CVE-2010-4341
Fixed in a distro release EPSS <1%
The pam_parse_in_data_v2 function in src/responder/pam/pamsrv_cmd.c in the PAM responder in SSSD 1.5.0, 1.4.x, and 1.3 allows local users to cause a denial of service (infinite loop, crash, and login prevention) via a crafted packet.
Products: fedorahosted sssd, fedoraproject sssd
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | sssd | 1.2.1-4.1 |
| Debian 13 | sssd | 1.2.1-4.1 |
| Red Hat Enterprise Linux 5 | sssd | 0:1.5.1-37.el5 |
| Red Hat Enterprise Linux 5 | sssd-client | 0:1.5.1-37.el5 |
| Red Hat Enterprise Linux 5 | sssd-debuginfo | 0:1.5.1-37.el5 |
| Red Hat Enterprise Linux 5 | sssd-tools | 0:1.5.1-37.el5 |
| Red Hat Enterprise Linux 6 | sssd | 0:1.5.1-34.el6 |
| Red Hat Enterprise Linux 6 | sssd-client | 0:1.5.1-34.el6 |
| Red Hat Enterprise Linux 6 | sssd-debuginfo | 0:1.5.1-34.el6 |
| Red Hat Enterprise Linux 6 | sssd-tools | 0:1.5.1-34.el6 |
| openSUSE Tumbleweed | sssd | 1.14.2-3.1 |