Description: "A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cache-expire subcommands. This flaw allows an attacker to trick the root user into running a specially crafted sssctl command, such as via sudo, to gain root access. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. This patch fixes a flaw by replacing system() with execvp()." Patches: - 2.x branch: https://github.com/SSSD/sssd/pull/5748 - 1.16.x branch: https://github.com/SSSD/sssd/pull/5749
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=52949343c8c1ca3d53c9b595f3c549ec08b38a1e commit 52949343c8c1ca3d53c9b595f3c549ec08b38a1e Author: Sam James <sam@gentoo.org> AuthorDate: 2021-09-18 23:36:24 +0000 Commit: Sam James <sam@gentoo.org> CommitDate: 2021-09-18 23:44:21 +0000 sys-auth/sssd: add patch for CVE-2021-3621 for 2.5.2 Bug: https://bugs.gentoo.org/808911 Signed-off-by: Sam James <sam@gentoo.org> sys-auth/sssd/Manifest | 1 + sys-auth/sssd/sssd-2.3.1-r3.ebuild | 2 +- sys-auth/sssd/sssd-2.5.2-r1.ebuild | 302 +++++++++++++++++++++++++++++++++++++ 3 files changed, 304 insertions(+), 1 deletion(-) https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=0fd94449ab622b0de7e70b8c47cada64dd0349e7 commit 0fd94449ab622b0de7e70b8c47cada64dd0349e7 Author: Jeremi Piotrowski <jpiotrowski@microsoft.com> AuthorDate: 2021-08-24 13:26:41 +0000 Commit: Sam James <sam@gentoo.org> CommitDate: 2021-09-18 23:43:51 +0000 sys-auth/sssd: add patch for CVE-2021-3621 for 2.3.1 This is a backport of https://github.com/SSSD/sssd/pull/5748 adapted to 2.3.1. A change was necessary: src/tools/sssctl/sssctl_logs.c wasn't passing '--no-create' to truncate in 2.3.1 yet. [sam@: moved file to devspace due to patch size] Bug: https://bugs.gentoo.org/808911 Signed-off-by: Jeremi Piotrowski <jpiotrowski@microsoft.com> Closes: https://github.com/gentoo/gentoo/pull/22159 Signed-off-by: Sam James <sam@gentoo.org> sys-auth/sssd/Manifest | 1 + sys-auth/sssd/sssd-2.3.1-r3.ebuild | 290 +++++++++++++++++++++++++++++++++++++ 2 files changed, 291 insertions(+)
A contributor from downstream at Flatcar Linux backported to 2.3.x so I assume it's useful for them, so let's keep that for now.
Vulnerable versions are no longer present in the tree.
