A flaw was found in SSSD's LDAP sudo provider. When the ldapsudosearch_base option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo privileges on all SSSD-enrolled hosts.
{
"binaries": [
{
"binary_version": "1.13.4-1ubuntu1.15",
"binary_name": "libipa-hbac0"
},
{
"binary_version": "1.13.4-1ubuntu1.15",
"binary_name": "libnss-sss"
},
{
"binary_version": "1.13.4-1ubuntu1.15",
"binary_name": "libpam-sss"
},
{
"binary_version": "1.13.4-1ubuntu1.15",
"binary_name": "libsss-idmap0"
},
{
"binary_version": "1.13.4-1ubuntu1.15",
"binary_name": "libsss-nss-idmap0"
},
{
"binary_version": "1.13.4-1ubuntu1.15",
"binary_name": "libsss-simpleifp0"
},
{
"binary_version": "1.13.4-1ubuntu1.15",
"binary_name": "libsss-sudo"
},
{
"binary_version": "1.13.4-1ubuntu1.15",
"binary_name": "libwbclient-sssd"
},
{
"binary_version": "1.13.4-1ubuntu1.15",
"binary_name": "python-libipa-hbac"
},
{
"binary_version": "1.13.4-1ubuntu1.15",
"binary_name": "python-libsss-nss-idmap"
},
{
"binary_version": "1.13.4-1ubuntu1.15",
"binary_name": "python-sss"
},
{
"binary_version": "1.13.4-1ubuntu1.15",
"binary_name": "python3-libipa-hbac"
},
{
"binary_version": "1.13.4-1ubuntu1.15",
"binary_name": "python3-libsss-nss-idmap"
},
{
"binary_version": "1.13.4-1ubuntu1.15",
"binary_name": "python3-sss"
},
{
"binary_version": "1.13.4-1ubuntu1.15",
"binary_name": "sssd"
},
{
"binary_version": "1.13.4-1ubuntu1.15",
"binary_name": "sssd-ad"
},
{
"binary_version": "1.13.4-1ubuntu1.15",
"binary_name": "sssd-ad-common"
},
{
"binary_version": "1.13.4-1ubuntu1.15",
"binary_name": "sssd-common"
},
{
"binary_version": "1.13.4-1ubuntu1.15",
"binary_name": "sssd-dbus"
},
{
"binary_version": "1.13.4-1ubuntu1.15",
"binary_name": "sssd-ipa"
},
{
"binary_version": "1.13.4-1ubuntu1.15",
"binary_name": "sssd-krb5"
},
{
"binary_version": "1.13.4-1ubuntu1.15",
"binary_name": "sssd-krb5-common"
},
{
"binary_version": "1.13.4-1ubuntu1.15",
"binary_name": "sssd-ldap"
},
{
"binary_version": "1.13.4-1ubuntu1.15",
"binary_name": "sssd-proxy"
},
{
"binary_version": "1.13.4-1ubuntu1.15",
"binary_name": "sssd-tools"
}
]
}{
"binaries": [
{
"binary_version": "1.16.1-1ubuntu1.8",
"binary_name": "libipa-hbac0"
},
{
"binary_version": "1.16.1-1ubuntu1.8",
"binary_name": "libnss-sss"
},
{
"binary_version": "1.16.1-1ubuntu1.8",
"binary_name": "libpam-sss"
},
{
"binary_version": "1.16.1-1ubuntu1.8",
"binary_name": "libsss-certmap0"
},
{
"binary_version": "1.16.1-1ubuntu1.8",
"binary_name": "libsss-idmap0"
},
{
"binary_version": "1.16.1-1ubuntu1.8",
"binary_name": "libsss-nss-idmap0"
},
{
"binary_version": "1.16.1-1ubuntu1.8",
"binary_name": "libsss-simpleifp0"
},
{
"binary_version": "1.16.1-1ubuntu1.8",
"binary_name": "libsss-sudo"
},
{
"binary_version": "1.16.1-1ubuntu1.8",
"binary_name": "libwbclient-sssd"
},
{
"binary_version": "1.16.1-1ubuntu1.8",
"binary_name": "python-libipa-hbac"
},
{
"binary_version": "1.16.1-1ubuntu1.8",
"binary_name": "python-libsss-nss-idmap"
},
{
"binary_version": "1.16.1-1ubuntu1.8",
"binary_name": "python-sss"
},
{
"binary_version": "1.16.1-1ubuntu1.8",
"binary_name": "python3-libipa-hbac"
},
{
"binary_version": "1.16.1-1ubuntu1.8",
"binary_name": "python3-libsss-nss-idmap"
},
{
"binary_version": "1.16.1-1ubuntu1.8",
"binary_name": "python3-sss"
},
{
"binary_version": "1.16.1-1ubuntu1.8",
"binary_name": "sssd"
},
{
"binary_version": "1.16.1-1ubuntu1.8",
"binary_name": "sssd-ad"
},
{
"binary_version": "1.16.1-1ubuntu1.8",
"binary_name": "sssd-ad-common"
},
{
"binary_version": "1.16.1-1ubuntu1.8",
"binary_name": "sssd-common"
},
{
"binary_version": "1.16.1-1ubuntu1.8",
"binary_name": "sssd-dbus"
},
{
"binary_version": "1.16.1-1ubuntu1.8",
"binary_name": "sssd-ipa"
},
{
"binary_version": "1.16.1-1ubuntu1.8",
"binary_name": "sssd-kcm"
},
{
"binary_version": "1.16.1-1ubuntu1.8",
"binary_name": "sssd-krb5"
},
{
"binary_version": "1.16.1-1ubuntu1.8",
"binary_name": "sssd-krb5-common"
},
{
"binary_version": "1.16.1-1ubuntu1.8",
"binary_name": "sssd-ldap"
},
{
"binary_version": "1.16.1-1ubuntu1.8",
"binary_name": "sssd-proxy"
},
{
"binary_version": "1.16.1-1ubuntu1.8",
"binary_name": "sssd-tools"
}
]
}{
"binaries": [
{
"binary_version": "2.2.3-3ubuntu0.13",
"binary_name": "libipa-hbac0"
},
{
"binary_version": "2.2.3-3ubuntu0.13",
"binary_name": "libnss-sss"
},
{
"binary_version": "2.2.3-3ubuntu0.13",
"binary_name": "libpam-sss"
},
{
"binary_version": "2.2.3-3ubuntu0.13",
"binary_name": "libsss-certmap0"
},
{
"binary_version": "2.2.3-3ubuntu0.13",
"binary_name": "libsss-idmap0"
},
{
"binary_version": "2.2.3-3ubuntu0.13",
"binary_name": "libsss-nss-idmap0"
},
{
"binary_version": "2.2.3-3ubuntu0.13",
"binary_name": "libsss-simpleifp0"
},
{
"binary_version": "2.2.3-3ubuntu0.13",
"binary_name": "libsss-sudo"
},
{
"binary_version": "2.2.3-3ubuntu0.13",
"binary_name": "libwbclient-sssd"
},
{
"binary_version": "2.2.3-3ubuntu0.13",
"binary_name": "python3-libipa-hbac"
},
{
"binary_version": "2.2.3-3ubuntu0.13",
"binary_name": "python3-libsss-nss-idmap"
},
{
"binary_version": "2.2.3-3ubuntu0.13",
"binary_name": "python3-sss"
},
{
"binary_version": "2.2.3-3ubuntu0.13",
"binary_name": "sssd"
},
{
"binary_version": "2.2.3-3ubuntu0.13",
"binary_name": "sssd-ad"
},
{
"binary_version": "2.2.3-3ubuntu0.13",
"binary_name": "sssd-ad-common"
},
{
"binary_version": "2.2.3-3ubuntu0.13",
"binary_name": "sssd-common"
},
{
"binary_version": "2.2.3-3ubuntu0.13",
"binary_name": "sssd-dbus"
},
{
"binary_version": "2.2.3-3ubuntu0.13",
"binary_name": "sssd-ipa"
},
{
"binary_version": "2.2.3-3ubuntu0.13",
"binary_name": "sssd-kcm"
},
{
"binary_version": "2.2.3-3ubuntu0.13",
"binary_name": "sssd-krb5"
},
{
"binary_version": "2.2.3-3ubuntu0.13",
"binary_name": "sssd-krb5-common"
},
{
"binary_version": "2.2.3-3ubuntu0.13",
"binary_name": "sssd-ldap"
},
{
"binary_version": "2.2.3-3ubuntu0.13",
"binary_name": "sssd-proxy"
},
{
"binary_version": "2.2.3-3ubuntu0.13",
"binary_name": "sssd-tools"
}
]
}{
"binaries": [
{
"binary_version": "2.6.3-1ubuntu3.6",
"binary_name": "libipa-hbac0"
},
{
"binary_version": "2.6.3-1ubuntu3.6",
"binary_name": "libnss-sss"
},
{
"binary_version": "2.6.3-1ubuntu3.6",
"binary_name": "libpam-sss"
},
{
"binary_version": "2.6.3-1ubuntu3.6",
"binary_name": "libsss-certmap0"
},
{
"binary_version": "2.6.3-1ubuntu3.6",
"binary_name": "libsss-idmap0"
},
{
"binary_version": "2.6.3-1ubuntu3.6",
"binary_name": "libsss-nss-idmap0"
},
{
"binary_version": "2.6.3-1ubuntu3.6",
"binary_name": "libsss-simpleifp0"
},
{
"binary_version": "2.6.3-1ubuntu3.6",
"binary_name": "libsss-sudo"
},
{
"binary_version": "2.6.3-1ubuntu3.6",
"binary_name": "python3-libipa-hbac"
},
{
"binary_version": "2.6.3-1ubuntu3.6",
"binary_name": "python3-libsss-nss-idmap"
},
{
"binary_version": "2.6.3-1ubuntu3.6",
"binary_name": "python3-sss"
},
{
"binary_version": "2.6.3-1ubuntu3.6",
"binary_name": "sssd"
},
{
"binary_version": "2.6.3-1ubuntu3.6",
"binary_name": "sssd-ad"
},
{
"binary_version": "2.6.3-1ubuntu3.6",
"binary_name": "sssd-ad-common"
},
{
"binary_version": "2.6.3-1ubuntu3.6",
"binary_name": "sssd-common"
},
{
"binary_version": "2.6.3-1ubuntu3.6",
"binary_name": "sssd-dbus"
},
{
"binary_version": "2.6.3-1ubuntu3.6",
"binary_name": "sssd-ipa"
},
{
"binary_version": "2.6.3-1ubuntu3.6",
"binary_name": "sssd-kcm"
},
{
"binary_version": "2.6.3-1ubuntu3.6",
"binary_name": "sssd-krb5"
},
{
"binary_version": "2.6.3-1ubuntu3.6",
"binary_name": "sssd-krb5-common"
},
{
"binary_version": "2.6.3-1ubuntu3.6",
"binary_name": "sssd-ldap"
},
{
"binary_version": "2.6.3-1ubuntu3.6",
"binary_name": "sssd-proxy"
},
{
"binary_version": "2.6.3-1ubuntu3.6",
"binary_name": "sssd-tools"
}
]
}{
"binaries": [
{
"binary_version": "2.9.4-1.1ubuntu6.6",
"binary_name": "libipa-hbac0t64"
},
{
"binary_version": "2.9.4-1.1ubuntu6.6",
"binary_name": "libnss-sss"
},
{
"binary_version": "2.9.4-1.1ubuntu6.6",
"binary_name": "libpam-sss"
},
{
"binary_version": "2.9.4-1.1ubuntu6.6",
"binary_name": "libsss-certmap0"
},
{
"binary_version": "2.9.4-1.1ubuntu6.6",
"binary_name": "libsss-idmap0"
},
{
"binary_version": "2.9.4-1.1ubuntu6.6",
"binary_name": "libsss-nss-idmap0"
},
{
"binary_version": "2.9.4-1.1ubuntu6.6",
"binary_name": "libsss-sudo"
},
{
"binary_version": "2.9.4-1.1ubuntu6.6",
"binary_name": "python3-libipa-hbac"
},
{
"binary_version": "2.9.4-1.1ubuntu6.6",
"binary_name": "python3-libsss-nss-idmap"
},
{
"binary_version": "2.9.4-1.1ubuntu6.6",
"binary_name": "python3-sss"
},
{
"binary_version": "2.9.4-1.1ubuntu6.6",
"binary_name": "sssd"
},
{
"binary_version": "2.9.4-1.1ubuntu6.6",
"binary_name": "sssd-ad"
},
{
"binary_version": "2.9.4-1.1ubuntu6.6",
"binary_name": "sssd-ad-common"
},
{
"binary_version": "2.9.4-1.1ubuntu6.6",
"binary_name": "sssd-common"
},
{
"binary_version": "2.9.4-1.1ubuntu6.6",
"binary_name": "sssd-dbus"
},
{
"binary_version": "2.9.4-1.1ubuntu6.6",
"binary_name": "sssd-idp"
},
{
"binary_version": "2.9.4-1.1ubuntu6.6",
"binary_name": "sssd-ipa"
},
{
"binary_version": "2.9.4-1.1ubuntu6.6",
"binary_name": "sssd-kcm"
},
{
"binary_version": "2.9.4-1.1ubuntu6.6",
"binary_name": "sssd-krb5"
},
{
"binary_version": "2.9.4-1.1ubuntu6.6",
"binary_name": "sssd-krb5-common"
},
{
"binary_version": "2.9.4-1.1ubuntu6.6",
"binary_name": "sssd-ldap"
},
{
"binary_version": "2.9.4-1.1ubuntu6.6",
"binary_name": "sssd-passkey"
},
{
"binary_version": "2.9.4-1.1ubuntu6.6",
"binary_name": "sssd-proxy"
},
{
"binary_version": "2.9.4-1.1ubuntu6.6",
"binary_name": "sssd-tools"
}
]
}{
"binaries": [
{
"binary_version": "2.10.1-2ubuntu5.3",
"binary_name": "libipa-hbac0t64"
},
{
"binary_version": "2.10.1-2ubuntu5.3",
"binary_name": "libnss-sss"
},
{
"binary_version": "2.10.1-2ubuntu5.3",
"binary_name": "libpam-sss"
},
{
"binary_version": "2.10.1-2ubuntu5.3",
"binary_name": "libsss-certmap0"
},
{
"binary_version": "2.10.1-2ubuntu5.3",
"binary_name": "libsss-idmap0"
},
{
"binary_version": "2.10.1-2ubuntu5.3",
"binary_name": "libsss-nss-idmap0"
},
{
"binary_version": "2.10.1-2ubuntu5.3",
"binary_name": "libsss-sudo"
},
{
"binary_version": "2.10.1-2ubuntu5.3",
"binary_name": "python3-libipa-hbac"
},
{
"binary_version": "2.10.1-2ubuntu5.3",
"binary_name": "python3-libsss-nss-idmap"
},
{
"binary_version": "2.10.1-2ubuntu5.3",
"binary_name": "python3-sss"
},
{
"binary_version": "2.10.1-2ubuntu5.3",
"binary_name": "sssd"
},
{
"binary_version": "2.10.1-2ubuntu5.3",
"binary_name": "sssd-ad"
},
{
"binary_version": "2.10.1-2ubuntu5.3",
"binary_name": "sssd-ad-common"
},
{
"binary_version": "2.10.1-2ubuntu5.3",
"binary_name": "sssd-common"
},
{
"binary_version": "2.10.1-2ubuntu5.3",
"binary_name": "sssd-dbus"
},
{
"binary_version": "2.10.1-2ubuntu5.3",
"binary_name": "sssd-idp"
},
{
"binary_version": "2.10.1-2ubuntu5.3",
"binary_name": "sssd-ipa"
},
{
"binary_version": "2.10.1-2ubuntu5.3",
"binary_name": "sssd-kcm"
},
{
"binary_version": "2.10.1-2ubuntu5.3",
"binary_name": "sssd-krb5"
},
{
"binary_version": "2.10.1-2ubuntu5.3",
"binary_name": "sssd-krb5-common"
},
{
"binary_version": "2.10.1-2ubuntu5.3",
"binary_name": "sssd-ldap"
},
{
"binary_version": "2.10.1-2ubuntu5.3",
"binary_name": "sssd-passkey"
},
{
"binary_version": "2.10.1-2ubuntu5.3",
"binary_name": "sssd-proxy"
},
{
"binary_version": "2.10.1-2ubuntu5.3",
"binary_name": "sssd-tools"
}
]
}{
"binaries": [
{
"binary_version": "2.12.0-1ubuntu5.1",
"binary_name": "libipa-hbac0t64"
},
{
"binary_version": "2.12.0-1ubuntu5.1",
"binary_name": "libnss-sss"
},
{
"binary_version": "2.12.0-1ubuntu5.1",
"binary_name": "libpam-sss"
},
{
"binary_version": "2.12.0-1ubuntu5.1",
"binary_name": "libsss-certmap0"
},
{
"binary_version": "2.12.0-1ubuntu5.1",
"binary_name": "libsss-idmap0"
},
{
"binary_version": "2.12.0-1ubuntu5.1",
"binary_name": "libsss-nss-idmap0"
},
{
"binary_version": "2.12.0-1ubuntu5.1",
"binary_name": "libsss-sudo"
},
{
"binary_version": "2.12.0-1ubuntu5.1",
"binary_name": "python3-libipa-hbac"
},
{
"binary_version": "2.12.0-1ubuntu5.1",
"binary_name": "python3-libsss-nss-idmap"
},
{
"binary_version": "2.12.0-1ubuntu5.1",
"binary_name": "python3-sss"
},
{
"binary_version": "2.12.0-1ubuntu5.1",
"binary_name": "sssd"
},
{
"binary_version": "2.12.0-1ubuntu5.1",
"binary_name": "sssd-ad"
},
{
"binary_version": "2.12.0-1ubuntu5.1",
"binary_name": "sssd-ad-common"
},
{
"binary_version": "2.12.0-1ubuntu5.1",
"binary_name": "sssd-common"
},
{
"binary_version": "2.12.0-1ubuntu5.1",
"binary_name": "sssd-dbus"
},
{
"binary_version": "2.12.0-1ubuntu5.1",
"binary_name": "sssd-idp"
},
{
"binary_version": "2.12.0-1ubuntu5.1",
"binary_name": "sssd-ipa"
},
{
"binary_version": "2.12.0-1ubuntu5.1",
"binary_name": "sssd-kcm"
},
{
"binary_version": "2.12.0-1ubuntu5.1",
"binary_name": "sssd-krb5"
},
{
"binary_version": "2.12.0-1ubuntu5.1",
"binary_name": "sssd-krb5-common"
},
{
"binary_version": "2.12.0-1ubuntu5.1",
"binary_name": "sssd-ldap"
},
{
"binary_version": "2.12.0-1ubuntu5.1",
"binary_name": "sssd-passkey"
},
{
"binary_version": "2.12.0-1ubuntu5.1",
"binary_name": "sssd-proxy"
},
{
"binary_version": "2.12.0-1ubuntu5.1",
"binary_name": "sssd-tools"
}
]
}