A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cache-expire subcommands. This flaw allows an attacker to trick the root user into running a specially crafted sssctl command, such as via sudo, to gain root access. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
References
| Link | Resource |
|---|---|
| https://bugzilla.redhat.com/show_bug.cgi?id=1975142 | Issue Tracking Patch Third Party Advisory |
| https://lists.debian.org/debian-lts-announce/2023/05/msg00028.html | Third Party Advisory |
| https://sssd.io/release-notes/sssd-2.6.0.html | Release Notes Third Party Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
History
04 Mar 2024, 22:58
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://lists.debian.org/debian-lts-announce/2023/05/msg00028.html - Third Party Advisory | |
| CPE | cpe:2.3:a:fedoraproject:sssd:2.6.0:*:*:*:*:*:*:* | |
| First Time |
Fedoraproject sssd
|
29 May 2023, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Information
Published : 2021-12-23 21:15
Updated : 2024-03-04 22:58
NVD link : CVE-2021-3621
Mitre link : CVE-2021-3621
CVE.ORG link : CVE-2021-3621
JSON object : View
Products Affected
redhat
- enterprise_linux
- enterprise_linux_server_aus
- virtualization_host
- enterprise_linux_eus
- enterprise_linux_server_tus
- virtualization
fedoraproject
- sssd
- fedora