CVE-2018-16838
Fixed in a distro release EPSS 1%CVSS 5.4
A flaw was found in sssd Group Policy Objects implementation. When the GPO is not readable by SSSD due to a too strict permission settings on the server side, SSSD will allow all authenticated users to login instead of denying access.
Products: fedoraproject sssd, redhat enterprise_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2 | libipa_hbac | 1.16.4-21.amzn2 |
| Amazon Linux 2 | libipa_hbac-devel | 1.16.4-21.amzn2 |
| Amazon Linux 2 | libsss_autofs | 1.16.4-21.amzn2 |
| Amazon Linux 2 | libsss_certmap | 1.16.4-21.amzn2 |
| Amazon Linux 2 | libsss_certmap-devel | 1.16.4-21.amzn2 |
| Amazon Linux 2 | libsss_idmap | 1.16.4-21.amzn2 |
| Amazon Linux 2 | libsss_idmap-devel | 1.16.4-21.amzn2 |
| Amazon Linux 2 | libsss_nss_idmap | 1.16.4-21.amzn2 |
| Amazon Linux 2 | libsss_nss_idmap-devel | 1.16.4-21.amzn2 |
| Amazon Linux 2 | libsss_simpleifp | 1.16.4-21.amzn2 |
| Amazon Linux 2 | libsss_simpleifp-devel | 1.16.4-21.amzn2 |
| Amazon Linux 2 | libsss_sudo | 1.16.4-21.amzn2 |
| Amazon Linux 2 | python-libipa_hbac | 1.16.4-21.amzn2 |
| Amazon Linux 2 | python-libsss_nss_idmap | 1.16.4-21.amzn2 |
| Amazon Linux 2 | python-sss | 1.16.4-21.amzn2 |
| Amazon Linux 2 | python-sss-murmur | 1.16.4-21.amzn2 |
| Amazon Linux 2 | python-sssdconfig | 1.16.4-21.amzn2 |
| Amazon Linux 2 | sssd | 1.16.4-21.amzn2 |
| Amazon Linux 2 | sssd-ad | 1.16.4-21.amzn2 |
| Amazon Linux 2 | sssd-client | 1.16.4-21.amzn2 |
| Amazon Linux 2 | sssd-common | 1.16.4-21.amzn2 |
| Amazon Linux 2 | sssd-common-pac | 1.16.4-21.amzn2 |
| Amazon Linux 2 | sssd-dbus | 1.16.4-21.amzn2 |
| Amazon Linux 2 | sssd-ipa | 1.16.4-21.amzn2 |
| Amazon Linux 2 | sssd-kcm | 1.16.4-21.amzn2 |
| Amazon Linux 2 | sssd-krb5 | 1.16.4-21.amzn2 |
| Amazon Linux 2 | sssd-krb5-common | 1.16.4-21.amzn2 |
| Amazon Linux 2 | sssd-ldap | 1.16.4-21.amzn2 |
| Amazon Linux 2 | sssd-libwbclient | 1.16.4-21.amzn2 |
| Amazon Linux 2 | sssd-libwbclient-devel | 1.16.4-21.amzn2 |
| Amazon Linux 2 | sssd-polkit-rules | 1.16.4-21.amzn2 |
| Amazon Linux 2 | sssd-proxy | 1.16.4-21.amzn2 |
| Amazon Linux 2 | sssd-tools | 1.16.4-21.amzn2 |
| Amazon Linux 2 | sssd-winbind-idmap | 1.16.4-21.amzn2 |
| Debian 10 | sssd | 1.16.3-3.2+deb10u1 |
| Debian 12 | sssd | 2.2.0-1 |
| Debian 13 | sssd | 2.2.0-1 |
| Red Hat Enterprise Linux 7 | imgbased | 0:1.1.9-0.1.el7ev |
| Red Hat Enterprise Linux 7 | libipa_hbac | 0:1.16.4-21.el7 |
| Red Hat Enterprise Linux 7 | libipa_hbac-devel | 0:1.16.4-21.el7 |
| Red Hat Enterprise Linux 7 | libsss_autofs | 0:1.16.4-21.el7 |
| Red Hat Enterprise Linux 7 | libsss_certmap | 0:1.16.4-21.el7 |
| Red Hat Enterprise Linux 7 | libsss_certmap-devel | 0:1.16.4-21.el7 |
| Red Hat Enterprise Linux 7 | libsss_idmap | 0:1.16.4-21.el7 |
| Red Hat Enterprise Linux 7 | libsss_idmap-devel | 0:1.16.4-21.el7 |
| Red Hat Enterprise Linux 7 | libsss_nss_idmap | 0:1.16.4-21.el7 |
| Red Hat Enterprise Linux 7 | libsss_nss_idmap-devel | 0:1.16.4-21.el7 |
| Red Hat Enterprise Linux 7 | libsss_simpleifp | 0:1.16.4-21.el7 |
| Red Hat Enterprise Linux 7 | libsss_simpleifp-devel | 0:1.16.4-21.el7 |
| Red Hat Enterprise Linux 7 | libsss_sudo | 0:1.16.4-21.el7 |
| Red Hat Enterprise Linux 7 | ovirt-node-ng | 0:4.3.5-0.20190717.0.el7ev |
| Red Hat Enterprise Linux 7 | ovirt-node-ng-nodectl | 0:4.3.5-0.20190717.0.el7ev |
| Red Hat Enterprise Linux 7 | python-imgbased | 0:1.1.9-0.1.el7ev |
| Red Hat Enterprise Linux 7 | python-libipa_hbac | 0:1.16.4-21.el7 |
| Red Hat Enterprise Linux 7 | python-libsss_nss_idmap | 0:1.16.4-21.el7 |
| Red Hat Enterprise Linux 7 | python-sss | 0:1.16.4-21.el7 |
| Red Hat Enterprise Linux 7 | python-sss-murmur | 0:1.16.4-21.el7 |
| Red Hat Enterprise Linux 7 | python-sssdconfig | 0:1.16.4-21.el7 |
| Red Hat Enterprise Linux 7 | python2-ovirt-node-ng-nodectl | 0:4.3.5-0.20190717.0.el7ev |
| Red Hat Enterprise Linux 7 | redhat-release-virtualization-host | 0:4.3.5-2.el7ev |
| Red Hat Enterprise Linux 7 | redhat-virtualization-host | 0:4.3.5-20190722.0.el7_7 |
| Red Hat Enterprise Linux 7 | redhat-virtualization-host-image-update | 0:4.3.5-20190722.0.el7_7 |
| Red Hat Enterprise Linux 7 | redhat-virtualization-host-image-update-placeholder | 0:4.3.5-2.el7ev |
| Red Hat Enterprise Linux 7 | sssd | 0:1.16.4-21.el7 |
| Red Hat Enterprise Linux 7 | sssd-ad | 0:1.16.4-21.el7 |
| Red Hat Enterprise Linux 7 | sssd-client | 0:1.16.4-21.el7 |
| Red Hat Enterprise Linux 7 | sssd-common | 0:1.16.4-21.el7 |
| Red Hat Enterprise Linux 7 | sssd-common-pac | 0:1.16.4-21.el7 |
| Red Hat Enterprise Linux 7 | sssd-dbus | 0:1.16.4-21.el7 |
| Red Hat Enterprise Linux 7 | sssd-debuginfo | 0:1.16.4-21.el7 |
| Red Hat Enterprise Linux 7 | sssd-ipa | 0:1.16.4-21.el7 |
| Red Hat Enterprise Linux 7 | sssd-kcm | 0:1.16.4-21.el7 |
| Red Hat Enterprise Linux 7 | sssd-krb5 | 0:1.16.4-21.el7 |
| Red Hat Enterprise Linux 7 | sssd-krb5-common | 0:1.16.4-21.el7 |
| Red Hat Enterprise Linux 7 | sssd-ldap | 0:1.16.4-21.el7 |
| Red Hat Enterprise Linux 7 | sssd-libwbclient | 0:1.16.4-21.el7 |
| Red Hat Enterprise Linux 7 | sssd-libwbclient-devel | 0:1.16.4-21.el7 |
| Red Hat Enterprise Linux 7 | sssd-polkit-rules | 0:1.16.4-21.el7 |
| Red Hat Enterprise Linux 7 | sssd-proxy | 0:1.16.4-21.el7 |
| Red Hat Enterprise Linux 7 | sssd-tools | 0:1.16.4-21.el7 |
| Red Hat Enterprise Linux 7 | sssd-winbind-idmap | 0:1.16.4-21.el7 |
| Red Hat Enterprise Linux 8 | libipa_hbac | 0:2.2.0-19.el8 |
| Red Hat Enterprise Linux 8 | libipa_hbac-debuginfo | 0:2.2.0-19.el8 |
| Red Hat Enterprise Linux 8 | libsss_autofs | 0:2.2.0-19.el8 |
| Red Hat Enterprise Linux 8 | libsss_autofs-debuginfo | 0:2.2.0-19.el8 |
| Red Hat Enterprise Linux 8 | libsss_certmap | 0:2.2.0-19.el8 |
| Red Hat Enterprise Linux 8 | libsss_certmap-debuginfo | 0:2.2.0-19.el8 |
| Red Hat Enterprise Linux 8 | libsss_idmap | 0:2.2.0-19.el8 |
| Red Hat Enterprise Linux 8 | libsss_idmap-debuginfo | 0:2.2.0-19.el8 |
| Red Hat Enterprise Linux 8 | libsss_nss_idmap | 0:2.2.0-19.el8 |
| Red Hat Enterprise Linux 8 | libsss_nss_idmap-debuginfo | 0:2.2.0-19.el8 |
| Red Hat Enterprise Linux 8 | libsss_nss_idmap-devel | 0:2.2.0-19.el8 |
| Red Hat Enterprise Linux 8 | libsss_simpleifp | 0:2.2.0-19.el8 |
| Red Hat Enterprise Linux 8 | libsss_simpleifp-debuginfo | 0:2.2.0-19.el8 |
| Red Hat Enterprise Linux 8 | libsss_sudo | 0:2.2.0-19.el8 |
| Red Hat Enterprise Linux 8 | libsss_sudo-debuginfo | 0:2.2.0-19.el8 |
| Red Hat Enterprise Linux 8 | python3-libipa_hbac | 0:2.2.0-19.el8 |
| Red Hat Enterprise Linux 8 | python3-libipa_hbac-debuginfo | 0:2.2.0-19.el8 |
| Red Hat Enterprise Linux 8 | python3-libsss_nss_idmap | 0:2.2.0-19.el8 |
| Red Hat Enterprise Linux 8 | python3-libsss_nss_idmap-debuginfo | 0:2.2.0-19.el8 |
| Red Hat Enterprise Linux 8 | python3-sss | 0:2.2.0-19.el8 |
| Red Hat Enterprise Linux 8 | python3-sss-debuginfo | 0:2.2.0-19.el8 |
| Red Hat Enterprise Linux 8 | python3-sss-murmur | 0:2.2.0-19.el8 |
| Red Hat Enterprise Linux 8 | python3-sss-murmur-debuginfo | 0:2.2.0-19.el8 |
| Red Hat Enterprise Linux 8 | python3-sssdconfig | 0:2.2.0-19.el8 |
| Red Hat Enterprise Linux 8 | sssd | 0:2.2.0-19.el8 |
| Red Hat Enterprise Linux 8 | sssd-ad | 0:2.2.0-19.el8 |
| Red Hat Enterprise Linux 8 | sssd-ad-debuginfo | 0:2.2.0-19.el8 |
| Red Hat Enterprise Linux 8 | sssd-client | 0:2.2.0-19.el8 |
| Red Hat Enterprise Linux 8 | sssd-client-debuginfo | 0:2.2.0-19.el8 |
| Red Hat Enterprise Linux 8 | sssd-common | 0:2.2.0-19.el8 |
| Red Hat Enterprise Linux 8 | sssd-common-debuginfo | 0:2.2.0-19.el8 |
| Red Hat Enterprise Linux 8 | sssd-common-pac | 0:2.2.0-19.el8 |
| Red Hat Enterprise Linux 8 | sssd-common-pac-debuginfo | 0:2.2.0-19.el8 |
| Red Hat Enterprise Linux 8 | sssd-dbus | 0:2.2.0-19.el8 |
| Red Hat Enterprise Linux 8 | sssd-dbus-debuginfo | 0:2.2.0-19.el8 |
| Red Hat Enterprise Linux 8 | sssd-debuginfo | 0:2.2.0-19.el8 |
| Red Hat Enterprise Linux 8 | sssd-debugsource | 0:2.2.0-19.el8 |
| Red Hat Enterprise Linux 8 | sssd-ipa | 0:2.2.0-19.el8 |
| Red Hat Enterprise Linux 8 | sssd-ipa-debuginfo | 0:2.2.0-19.el8 |
| Red Hat Enterprise Linux 8 | sssd-kcm | 0:2.2.0-19.el8 |
| Red Hat Enterprise Linux 8 | sssd-kcm-debuginfo | 0:2.2.0-19.el8 |
| Red Hat Enterprise Linux 8 | sssd-krb5 | 0:2.2.0-19.el8 |
| Red Hat Enterprise Linux 8 | sssd-krb5-common | 0:2.2.0-19.el8 |
| Red Hat Enterprise Linux 8 | sssd-krb5-common-debuginfo | 0:2.2.0-19.el8 |
| Red Hat Enterprise Linux 8 | sssd-krb5-debuginfo | 0:2.2.0-19.el8 |
| Red Hat Enterprise Linux 8 | sssd-ldap | 0:2.2.0-19.el8 |
| Red Hat Enterprise Linux 8 | sssd-ldap-debuginfo | 0:2.2.0-19.el8 |
| Red Hat Enterprise Linux 8 | sssd-libwbclient | 0:2.2.0-19.el8 |
| Red Hat Enterprise Linux 8 | sssd-libwbclient-debuginfo | 0:2.2.0-19.el8 |
| Red Hat Enterprise Linux 8 | sssd-nfs-idmap | 0:2.2.0-19.el8 |
| Red Hat Enterprise Linux 8 | sssd-nfs-idmap-debuginfo | 0:2.2.0-19.el8 |
| Red Hat Enterprise Linux 8 | sssd-polkit-rules | 0:2.2.0-19.el8 |
| Red Hat Enterprise Linux 8 | sssd-proxy | 0:2.2.0-19.el8 |
| Red Hat Enterprise Linux 8 | sssd-proxy-debuginfo | 0:2.2.0-19.el8 |
| Red Hat Enterprise Linux 8 | sssd-tools | 0:2.2.0-19.el8 |
| Red Hat Enterprise Linux 8 | sssd-tools-debuginfo | 0:2.2.0-19.el8 |
| Red Hat Enterprise Linux 8 | sssd-winbind-idmap | 0:2.2.0-19.el8 |
| Red Hat Enterprise Linux 8 | sssd-winbind-idmap-debuginfo | 0:2.2.0-19.el8 |
| SUSE Linux Enterprise Desktop 12 SP3 | sssd | 1.13.4-34.37.1 |
| SUSE Linux Enterprise Desktop 12 SP4 | sssd | 1.16.1-4.12.2 |
| SUSE Linux Enterprise Module for Basesystem 15 | sssd | 1.16.1-3.24.6 |
| SUSE Linux Enterprise Module for Basesystem 15 SP1 | sssd | 1.16.1-3.24.6 |
| SUSE Linux Enterprise Server 12 SP3 | sssd | 1.13.4-34.37.1 |
| SUSE Linux Enterprise Server 12 SP4 | sssd | 1.16.1-4.12.2 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | sssd | 1.13.4-34.37.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP4 | sssd | 1.16.1-4.12.2 |
| SUSE Linux Enterprise Software Development Kit 12 SP3 | sssd | 1.13.4-34.37.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP4 | sssd | 1.16.1-4.12.2 |
| Ubuntu 18.04 LTS | sssd | 1.16.1-1ubuntu1.8 |
| Ubuntu 20.04 LTS | sssd | 2.2.3-3ubuntu0.7 |
| Ubuntu Pro 16.04 LTS | sssd | no fix |
| openSUSE Leap 15.0 | sssd | 1.16.1-lp151.7.3.1 |
| openSUSE Leap 15.1 | sssd | 1.16.1-lp151.7.3.1 |
| openSUSE Tumbleweed | sssd | 2.9.3-2.1 |