CVE-2018-10852
Fixed in a distro release EPSS 1%CVSS 3.8
The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD has too wide permissions, which means that anyone who can send a message using the same raw protocol that sudo and SSSD use can read the sudo rules available for any user. This affects versions of SSSD before 1.16.3.
Products: debian_linux, fedoraproject sssd, redhat enterprise_linux_desktop, redhat enterprise_linux_server, redhat enterprise_linux_workstation
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2 | libipa_hbac | 1.16.2-13.amzn2.0.1 |
| Amazon Linux 2 | libipa_hbac-devel | 1.16.2-13.amzn2.0.1 |
| Amazon Linux 2 | libsss_autofs | 1.16.2-13.amzn2.0.1 |
| Amazon Linux 2 | libsss_certmap | 1.16.2-13.amzn2.0.1 |
| Amazon Linux 2 | libsss_certmap-devel | 1.16.2-13.amzn2.0.1 |
| Amazon Linux 2 | libsss_idmap | 1.16.2-13.amzn2.0.1 |
| Amazon Linux 2 | libsss_idmap-devel | 1.16.2-13.amzn2.0.1 |
| Amazon Linux 2 | libsss_nss_idmap | 1.16.2-13.amzn2.0.1 |
| Amazon Linux 2 | libsss_nss_idmap-devel | 1.16.2-13.amzn2.0.1 |
| Amazon Linux 2 | libsss_simpleifp | 1.16.2-13.amzn2.0.1 |
| Amazon Linux 2 | libsss_simpleifp-devel | 1.16.2-13.amzn2.0.1 |
| Amazon Linux 2 | libsss_sudo | 1.16.2-13.amzn2.0.1 |
| Amazon Linux 2 | python-libipa_hbac | 1.16.2-13.amzn2.0.1 |
| Amazon Linux 2 | python-libsss_nss_idmap | 1.16.2-13.amzn2.0.1 |
| Amazon Linux 2 | python-sss | 1.16.2-13.amzn2.0.1 |
| Amazon Linux 2 | python-sss-murmur | 1.16.2-13.amzn2.0.1 |
| Amazon Linux 2 | python-sssdconfig | 1.16.2-13.amzn2.0.1 |
| Amazon Linux 2 | sssd | 1.16.2-13.amzn2.0.1 |
| Amazon Linux 2 | sssd-ad | 1.16.2-13.amzn2.0.1 |
| Amazon Linux 2 | sssd-client | 1.16.2-13.amzn2.0.1 |
| Amazon Linux 2 | sssd-common | 1.16.2-13.amzn2.0.1 |
| Amazon Linux 2 | sssd-common-pac | 1.16.2-13.amzn2.0.1 |
| Amazon Linux 2 | sssd-dbus | 1.16.2-13.amzn2.0.1 |
| Amazon Linux 2 | sssd-ipa | 1.16.2-13.amzn2.0.1 |
| Amazon Linux 2 | sssd-kcm | 1.16.2-13.amzn2.0.1 |
| Amazon Linux 2 | sssd-krb5 | 1.16.2-13.amzn2.0.1 |
| Amazon Linux 2 | sssd-krb5-common | 1.16.2-13.amzn2.0.1 |
| Amazon Linux 2 | sssd-ldap | 1.16.2-13.amzn2.0.1 |
| Amazon Linux 2 | sssd-libwbclient | 1.16.2-13.amzn2.0.1 |
| Amazon Linux 2 | sssd-libwbclient-devel | 1.16.2-13.amzn2.0.1 |
| Amazon Linux 2 | sssd-polkit-rules | 1.16.2-13.amzn2.0.1 |
| Amazon Linux 2 | sssd-proxy | 1.16.2-13.amzn2.0.1 |
| Amazon Linux 2 | sssd-tools | 1.16.2-13.amzn2.0.1 |
| Amazon Linux 2 | sssd-winbind-idmap | 1.16.2-13.amzn2.0.1 |
| Debian 12 | sssd | 1.16.3-1 |
| Debian 13 | sssd | 1.16.3-1 |
| Debian 8 | sssd | 1.11.7-3+deb8u1 |
| Red Hat Enterprise Linux 7 | libipa_hbac | 0:1.16.2-13.el7 |
| Red Hat Enterprise Linux 7 | libipa_hbac-devel | 0:1.16.2-13.el7 |
| Red Hat Enterprise Linux 7 | libsss_autofs | 0:1.16.2-13.el7 |
| Red Hat Enterprise Linux 7 | libsss_certmap | 0:1.16.2-13.el7 |
| Red Hat Enterprise Linux 7 | libsss_certmap-devel | 0:1.16.2-13.el7 |
| Red Hat Enterprise Linux 7 | libsss_idmap | 0:1.16.2-13.el7 |
| Red Hat Enterprise Linux 7 | libsss_idmap-devel | 0:1.16.2-13.el7 |
| Red Hat Enterprise Linux 7 | libsss_nss_idmap | 0:1.16.2-13.el7 |
| Red Hat Enterprise Linux 7 | libsss_nss_idmap-devel | 0:1.16.2-13.el7 |
| Red Hat Enterprise Linux 7 | libsss_simpleifp | 0:1.16.2-13.el7 |
| Red Hat Enterprise Linux 7 | libsss_simpleifp-devel | 0:1.16.2-13.el7 |
| Red Hat Enterprise Linux 7 | libsss_sudo | 0:1.16.2-13.el7 |
| Red Hat Enterprise Linux 7 | python-libipa_hbac | 0:1.16.2-13.el7 |
| Red Hat Enterprise Linux 7 | python-libsss_nss_idmap | 0:1.16.2-13.el7 |
| Red Hat Enterprise Linux 7 | python-sss | 0:1.16.2-13.el7 |
| Red Hat Enterprise Linux 7 | python-sss-murmur | 0:1.16.2-13.el7 |
| Red Hat Enterprise Linux 7 | python-sssdconfig | 0:1.16.2-13.el7 |
| Red Hat Enterprise Linux 7 | sssd | 0:1.16.2-13.el7 |
| Red Hat Enterprise Linux 7 | sssd-ad | 0:1.16.2-13.el7 |
| Red Hat Enterprise Linux 7 | sssd-client | 0:1.16.2-13.el7 |
| Red Hat Enterprise Linux 7 | sssd-common | 0:1.16.2-13.el7 |
| Red Hat Enterprise Linux 7 | sssd-common-pac | 0:1.16.2-13.el7 |
| Red Hat Enterprise Linux 7 | sssd-dbus | 0:1.16.2-13.el7 |
| Red Hat Enterprise Linux 7 | sssd-debuginfo | 0:1.16.2-13.el7 |
| Red Hat Enterprise Linux 7 | sssd-ipa | 0:1.16.2-13.el7 |
| Red Hat Enterprise Linux 7 | sssd-kcm | 0:1.16.2-13.el7 |
| Red Hat Enterprise Linux 7 | sssd-krb5 | 0:1.16.2-13.el7 |
| Red Hat Enterprise Linux 7 | sssd-krb5-common | 0:1.16.2-13.el7 |
| Red Hat Enterprise Linux 7 | sssd-ldap | 0:1.16.2-13.el7 |
| Red Hat Enterprise Linux 7 | sssd-libwbclient | 0:1.16.2-13.el7 |
| Red Hat Enterprise Linux 7 | sssd-libwbclient-devel | 0:1.16.2-13.el7 |
| Red Hat Enterprise Linux 7 | sssd-polkit-rules | 0:1.16.2-13.el7 |
| Red Hat Enterprise Linux 7 | sssd-proxy | 0:1.16.2-13.el7 |
| Red Hat Enterprise Linux 7 | sssd-tools | 0:1.16.2-13.el7 |
| Red Hat Enterprise Linux 7 | sssd-winbind-idmap | 0:1.16.2-13.el7 |
| SUSE Enterprise Storage 4 | sssd | 1.13.4-34.23.1 |
| SUSE Linux Enterprise Desktop 12 SP3 | sssd | 1.13.4-34.23.1 |
| SUSE Linux Enterprise Desktop 12 SP4 | sssd | 1.16.1-4.3.2 |
| SUSE Linux Enterprise Module for Basesystem 15 | sssd | 1.16.1-3.3.1 |
| SUSE Linux Enterprise Server 12 SP2-LTSS | sssd | 1.13.4-34.23.1 |
| SUSE Linux Enterprise Server 12 SP3 | sssd | 1.13.4-34.23.1 |
| SUSE Linux Enterprise Server 12 SP4 | sssd | 1.16.1-4.3.2 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP2 | sssd | 1.13.4-34.23.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | sssd | 1.13.4-34.23.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP4 | sssd | 1.16.1-4.3.2 |
| SUSE Linux Enterprise Software Development Kit 12 SP3 | sssd | 1.13.4-34.23.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP4 | sssd | 1.16.1-4.3.2 |
| SUSE OpenStack Cloud 7 | sssd | 1.13.4-34.23.1 |
| Ubuntu 18.04 LTS | sssd | 1.16.1-1ubuntu1.8 |
| Ubuntu 20.04 LTS | sssd | 2.2.3-3ubuntu0.7 |
| Ubuntu Pro 16.04 LTS | sssd | no fix |
| openSUSE Tumbleweed | sssd | 2.5.2-1.4 |