Improper privilege management in System Security Services Daemon (SSSD) - CVE-2025-11561

Vulnerability identifier: #VU117689

CSH Severity: Medium

CVSS v4: 6.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H]

CVE-ID: CVE-2025-11561

CWE-ID: CWE-269

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to bypass authorization checks.

The vulnerability exists due to improper privilege management within the Active Directory integration feature. In default configurations, the Kerberos local authentication plugin (sssd_krb5_localauth_plugin) is enabled, but a fallback to the an2ln plugin is possible. This fallback allows an attacker with permission to modify certain AD attributes (such as userPrincipalName or samAccountName) to impersonate privileged users, potentially resulting in unauthorized access or privilege escalation on domain-joined Linux hosts.

System Security Services Daemon (SSSD)
SUSE Manager Server 4.3
SUSE Manager Retail Branch Server 4.3
SUSE Linux Enterprise Server 15 SP3
SUSE Manager Proxy 4.3
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 12 SP5
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Manager Server
SUSE Linux Enterprise Micro for Rancher
SUSE Linux Enterprise Micro
SUSE Linux Micro
Anolis OS
SUSE Enterprise Storage
Red Hat CodeReady Linux Builder for IBM z Systems
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux Server - AUS
Basesystem Module
openSUSE Leap
openEuler
Fedora
Netezza Appliance
IBM Power Hardware Management Console (HMC)
sssd-ipa-debuginfo
sssd-dbus
sssd-tools-debuginfo
sssd-common-debuginfo-32bit
sssd-common-32bit
python-sssd-config
libsss_simpleifp0
sssd-common-debuginfo
sssd-krb5-common-debuginfo
libsss_simpleifp0-debuginfo
sssd-ldap
libsss_nss_idmap0
libsss_idmap-devel
libsss_certmap0-debuginfo
libipa_hbac-devel
libsss_nss_idmap-devel
libsss_idmap0-debuginfo
sssd-dbus-debuginfo
sssd-krb5
sssd-ad
sssd-common
libsss_certmap0
sssd-ldap-debuginfo
sssd-ipa
libipa_hbac0-debuginfo
sssd-proxy
sssd-krb5-common
sssd-krb5-debuginfo
sssd-debugsource
python-sssd-config-debuginfo
libsss_nss_idmap0-debuginfo
sssd-proxy-debuginfo
sssd-ad-debuginfo
sssd
libipa_hbac0
sssd-tools
libsss_idmap0
python3-sss_nss_idmap
sssd-wbclient
python3-sssd-config-debuginfo
libsss_certmap-devel
python3-sss_nss_idmap-debuginfo
python3-ipa_hbac-debuginfo
sssd-winbind-idmap-debuginfo
python3-ipa_hbac
sssd-wbclient-debuginfo
sssd-common-32bit-debuginfo
sssd-common-64bit
sssd-common-64bit-debuginfo
libnfsidmap-sss-debuginfo
python3-sss-murmur
sssd-winbind-idmap
libnfsidmap-sss
python3-sssd-config
sssd-wbclient-devel
libsss_simpleifp-devel
python3-sss-murmur-debuginfo
python-sssdconfig
libsss_sudo
sssd-kcm
sssd-common-pac
sssd-client
python-sss-murmur
python-sss
python-libsss_nss_idmap
python-libipa_hbac
libsss_simpleifp
libsss_nss_idmap
libsss_idmap
libsss_certmap
libsss_autofs
libipa_hbac
sssd-libwbclient
sssd-libwbclient-devel
sssd-polkit-rules
sssd (Red Hat package)
python2-sssd
python3-sssd
sssd-debuginfo
sssd-devel
sssd-help
sssd-kcm-debuginfo
sssd-64bit
sssd-64bit-debuginfo
sssd-32bit
sssd-32bit-debuginfo
python3-sssdconfig
python3-libipa_hbac
python3-libsss_nss_idmap
python3-sss
sssd-nfs-idmap
sssd-idp
Red Hat OpenShift Container Platform
Juniper Junos Space

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Netezza Appliance - update to 1.0.0.1
IBM Power Hardware Management Console (HMC) - addressed in versions 10.3.1063.1, 11.1.1111.4
sssd-ipa-debuginfo - addressed in versions 1.16.1-7.68.1, 1.16.1-150300.23.56.1, 2.5.2-150400.4.40.1, 2.5.2-150500.10.39.1, 2.9.3-150600.3.28.1, 2.9.3-150700.9.9.1
sssd-dbus - addressed in versions 1.16.1-7.68.1, 1.16.1-150300.23.56.1, 2.5.2-150400.4.40.1, 2.5.2-150500.10.39.1, 2.8.2-7.1, 2.9.3-150600.3.28.1, 2.9.3-150700.9.9.1, 2.9.5-slfo.1.1_4.1
sssd-tools-debuginfo - addressed in versions 1.16.1-7.68.1, 1.16.1-150300.23.56.1, 2.5.2-150400.4.40.1, 2.5.2-150500.10.39.1, 2.8.2-7.1, 2.9.3-150600.3.28.1, 2.9.3-150700.9.9.1, 2.9.5-slfo.1.1_4.1
sssd-common-debuginfo-32bit - update to 1.16.1-7.68.1
sssd-common-32bit - addressed in versions 1.16.1-7.68.1, 1.16.1-150300.23.56.1, 2.5.2-150400.4.40.1, 2.5.2-150500.10.39.1
python-sssd-config - update to 1.16.1-7.68.1
libsss_simpleifp0 - addressed in versions 1.16.1-7.68.1, 1.16.1-150300.23.56.1, 2.5.2-150400.4.40.1, 2.5.2-150500.10.39.1, 2.9.3-150600.3.28.1, 2.9.3-150700.9.9.1
sssd-common-debuginfo - addressed in versions 1.16.1-7.68.1, 1.16.1-150300.23.56.1, 2.5.2-150400.4.40.1, 2.5.2-150500.10.39.1
sssd-krb5-common-debuginfo - addressed in versions 1.16.1-7.68.1, 1.16.1-150300.23.56.1, 2.5.2-150400.4.40.1, 2.5.2-150500.10.39.1, 2.8.2-7.1, 2.9.3-150600.3.28.1, 2.9.3-150700.9.9.1, 2.9.5-slfo.1.1_4.1
libsss_simpleifp0-debuginfo - addressed in versions 1.16.1-7.68.1, 1.16.1-150300.23.56.1, 2.5.2-150400.4.40.1, 2.5.2-150500.10.39.1, 2.9.3-150600.3.28.1, 2.9.3-150700.9.9.1
sssd-ldap - addressed in versions 1.16.1-7.68.1, 1.16.1-150300.23.56.1, 2.5.2-150400.4.40.1, 2.5.2-150500.10.39.1, 2.8.2-7.1, 2.9.3-150600.3.28.1, 2.9.3-150700.9.9.1, 2.9.5-slfo.1.1_4.1
libsss_nss_idmap0 - addressed in versions 1.16.1-7.68.1, 1.16.1-150300.23.56.1, 2.5.2-150400.4.40.1, 2.5.2-150500.10.39.1, 2.8.2-7.1, 2.9.3-150600.3.28.1, 2.9.3-150700.9.9.1, 2.9.5-slfo.1.1_4.1
libsss_idmap-devel - addressed in versions 1.16.1-7.68.1, 1.16.1-150300.23.56.1, 2.5.2-150400.4.40.1, 2.5.2-150500.10.39.1, 2.9.3-150600.3.28.1, 2.9.3-150700.9.9.1
libsss_certmap0-debuginfo - addressed in versions 1.16.1-7.68.1, 1.16.1-150300.23.56.1, 2.5.2-150400.4.40.1, 2.5.2-150500.10.39.1, 2.8.2-7.1, 2.9.3-150600.3.28.1, 2.9.3-150700.9.9.1, 2.9.5-slfo.1.1_4.1
libipa_hbac-devel - addressed in versions 1.16.1-7.68.1, 1.16.1-150300.23.56.1, 2.5.2-150400.4.40.1, 2.5.2-150500.10.39.1, 2.9.3-150600.3.28.1, 2.9.3-150700.9.9.1
libsss_nss_idmap-devel - addressed in versions 1.16.1-7.68.1, 1.16.1-150300.23.56.1, 2.5.2-150400.4.40.1, 2.5.2-150500.10.39.1, 2.9.3-150600.3.28.1, 2.9.3-150700.9.9.1
libsss_idmap0-debuginfo - addressed in versions 1.16.1-7.68.1, 1.16.1-150300.23.56.1, 2.5.2-150400.4.40.1, 2.5.2-150500.10.39.1, 2.8.2-7.1, 2.9.3-150600.3.28.1, 2.9.3-150700.9.9.1, 2.9.5-slfo.1.1_4.1
sssd-dbus-debuginfo - addressed in versions 1.16.1-7.68.1, 1.16.1-150300.23.56.1, 2.5.2-150400.4.40.1, 2.5.2-150500.10.39.1, 2.8.2-7.1, 2.9.3-150600.3.28.1, 2.9.3-150700.9.9.1, 2.9.5-slfo.1.1_4.1
sssd-krb5 - addressed in versions 1.16.1-7.68.1, 1.16.1-150300.23.56.1, 2.5.2-150400.4.40.1, 2.5.2-150500.10.39.1, 2.8.2-7.1, 2.9.3-150600.3.28.1, 2.9.3-150700.9.9.1, 2.9.5-slfo.1.1_4.1
sssd-ad - addressed in versions 1.16.1-7.68.1, 1.16.1-150300.23.56.1, 2.5.2-150400.4.40.1, 2.5.2-150500.10.39.1, 2.8.2-7.1, 2.9.3-150600.3.28.1, 2.9.3-150700.9.9.1, 2.9.5-slfo.1.1_4.1
sssd-common - addressed in versions 1.16.1-7.68.1, 1.16.1-150300.23.56.1, 2.5.2-150400.4.40.1, 2.5.2-150500.10.39.1
libsss_certmap0 - addressed in versions 1.16.1-7.68.1, 1.16.1-150300.23.56.1, 2.5.2-150400.4.40.1, 2.5.2-150500.10.39.1, 2.8.2-7.1, 2.9.3-150600.3.28.1, 2.9.3-150700.9.9.1, 2.9.5-slfo.1.1_4.1
sssd-ldap-debuginfo - addressed in versions 1.16.1-7.68.1, 1.16.1-150300.23.56.1, 2.5.2-150400.4.40.1, 2.5.2-150500.10.39.1, 2.8.2-7.1, 2.9.3-150600.3.28.1, 2.9.3-150700.9.9.1, 2.9.5-slfo.1.1_4.1
sssd-ipa - addressed in versions 1.16.1-7.68.1, 1.16.1-150300.23.56.1, 2.5.2-150400.4.40.1, 2.5.2-150500.10.39.1, 2.9.3-150600.3.28.1, 2.9.3-150700.9.9.1
libipa_hbac0-debuginfo - addressed in versions 1.16.1-7.68.1, 1.16.1-150300.23.56.1, 2.5.2-150400.4.40.1, 2.5.2-150500.10.39.1, 2.9.3-150600.3.28.1, 2.9.3-150700.9.9.1
sssd-proxy - addressed in versions 1.16.1-7.68.1, 1.16.1-150300.23.56.1, 2.5.2-150400.4.40.1, 2.5.2-150500.10.39.1, 2.9.3-150600.3.28.1, 2.9.3-150700.9.9.1
sssd-krb5-common - addressed in versions 1.16.1-7.68.1, 1.16.1-150300.23.56.1, 2.5.2-150400.4.40.1, 2.5.2-150500.10.39.1, 2.8.2-7.1, 2.9.3-150600.3.28.1, 2.9.3-150700.9.9.1, 2.9.5-slfo.1.1_4.1
sssd-krb5-debuginfo - addressed in versions 1.16.1-7.68.1, 1.16.1-150300.23.56.1, 2.5.2-150400.4.40.1, 2.5.2-150500.10.39.1, 2.8.2-7.1, 2.9.3-150600.3.28.1, 2.9.3-150700.9.9.1, 2.9.5-slfo.1.1_4.1
sssd-debugsource - addressed in versions 1.16.1-7.68.1, 1.16.1-150300.23.56.1, 2.5.2-150400.4.40.1, 2.5.2-150500.10.39.1, 2.8.2-7.1, 2.9.3-150600.3.28.1, 2.9.3-150700.9.9.1, 2.9.5-slfo.1.1_4.1
python-sssd-config-debuginfo - update to 1.16.1-7.68.1
libsss_nss_idmap0-debuginfo - addressed in versions 1.16.1-7.68.1, 1.16.1-150300.23.56.1, 2.5.2-150400.4.40.1, 2.5.2-150500.10.39.1, 2.8.2-7.1, 2.9.3-150600.3.28.1, 2.9.3-150700.9.9.1, 2.9.5-slfo.1.1_4.1
sssd-proxy-debuginfo - addressed in versions 1.16.1-7.68.1, 1.16.1-150300.23.56.1, 2.5.2-150400.4.40.1, 2.5.2-150500.10.39.1, 2.9.3-150600.3.28.1, 2.9.3-150700.9.9.1
sssd-ad-debuginfo - addressed in versions 1.16.1-7.68.1, 1.16.1-150300.23.56.1, 2.5.2-150400.4.40.1, 2.5.2-150500.10.39.1, 2.8.2-7.1, 2.9.3-150600.3.28.1, 2.9.3-150700.9.9.1, 2.9.5-slfo.1.1_4.1
sssd - addressed in versions 1.16.1-7.68.1, 1.16.1-150300.23.56.1, 2.5.2-150400.4.40.1, 2.5.2-150500.10.39.1, 2.8.2-7.1, 2.9.3-150600.3.28.1, 2.9.3-150700.9.9.1, 2.9.5-slfo.1.1_4.1
libipa_hbac0 - addressed in versions 1.16.1-7.68.1, 1.16.1-150300.23.56.1, 2.5.2-150400.4.40.1, 2.5.2-150500.10.39.1, 2.9.3-150600.3.28.1, 2.9.3-150700.9.9.1
sssd-tools - addressed in versions 1.16.1-7.68.1, 1.16.1-150300.23.56.1, 2.5.2-150400.4.40.1, 2.5.2-150500.10.39.1, 2.8.2-7.1, 2.9.3-150600.3.28.1, 2.9.3-150700.9.9.1, 2.9.5-slfo.1.1_4.1
libsss_idmap0 - addressed in versions 1.16.1-7.68.1, 1.16.1-150300.23.56.1, 2.5.2-150400.4.40.1, 2.5.2-150500.10.39.1, 2.8.2-7.1, 2.9.3-150600.3.28.1, 2.9.3-150700.9.9.1, 2.9.5-slfo.1.1_4.1
python3-sss_nss_idmap - addressed in versions 1.16.1-150300.23.56.1, 2.5.2-150400.4.40.1, 2.5.2-150500.10.39.1, 2.9.3-150600.3.28.1
sssd-wbclient - update to 1.16.1-150300.23.56.1
python3-sssd-config-debuginfo - addressed in versions 1.16.1-150300.23.56.1, 2.5.2-150400.4.40.1, 2.5.2-150500.10.39.1, 2.8.2-7.1, 2.9.3-150600.3.28.1, 2.9.3-150700.9.9.1, 2.9.5-slfo.1.1_4.1
libsss_certmap-devel - addressed in versions 1.16.1-150300.23.56.1, 2.5.2-150400.4.40.1, 2.5.2-150500.10.39.1, 2.9.3-150600.3.28.1, 2.9.3-150700.9.9.1
python3-sss_nss_idmap-debuginfo - addressed in versions 1.16.1-150300.23.56.1, 2.5.2-150400.4.40.1, 2.5.2-150500.10.39.1, 2.9.3-150600.3.28.1
python3-ipa_hbac-debuginfo - addressed in versions 1.16.1-150300.23.56.1, 2.5.2-150400.4.40.1, 2.5.2-150500.10.39.1, 2.9.3-150600.3.28.1
sssd-winbind-idmap-debuginfo - addressed in versions 1.16.1-150300.23.56.1, 2.5.2-150400.4.40.1, 2.5.2-150500.10.39.1, 2.9.3-150600.3.28.1, 2.9.3-150700.9.9.1
python3-ipa_hbac - addressed in versions 1.16.1-150300.23.56.1, 2.5.2-150400.4.40.1, 2.5.2-150500.10.39.1, 2.9.3-150600.3.28.1
sssd-wbclient-debuginfo - update to 1.16.1-150300.23.56.1
sssd-common-32bit-debuginfo - addressed in versions 1.16.1-150300.23.56.1, 2.5.2-150400.4.40.1, 2.5.2-150500.10.39.1
sssd-common-64bit - addressed in versions 1.16.1-150300.23.56.1, 2.5.2-150400.4.40.1, 2.5.2-150500.10.39.1
sssd-common-64bit-debuginfo - addressed in versions 1.16.1-150300.23.56.1, 2.5.2-150400.4.40.1, 2.5.2-150500.10.39.1
libnfsidmap-sss-debuginfo - addressed in versions 1.16.1-150300.23.56.1, 2.5.2-150400.4.40.1, 2.5.2-150500.10.39.1, 2.9.3-150600.3.28.1
python3-sss-murmur - addressed in versions 1.16.1-150300.23.56.1, 2.5.2-150400.4.40.1, 2.5.2-150500.10.39.1, 2.9.3-150600.3.28.1
sssd-winbind-idmap - addressed in versions 1.16.1-150300.23.56.1, 2.5.2-150400.4.40.1, 2.5.2-150500.10.39.1, 2.9.3-150600.3.28.1, 2.9.3-150700.9.9.1
libnfsidmap-sss - addressed in versions 1.16.1-150300.23.56.1, 2.5.2-150400.4.40.1, 2.5.2-150500.10.39.1, 2.9.3-150600.3.28.1
python3-sssd-config - addressed in versions 1.16.1-150300.23.56.1, 2.5.2-150400.4.40.1, 2.5.2-150500.10.39.1, 2.8.2-7.1, 2.9.3-150600.3.28.1, 2.9.3-150700.9.9.1, 2.9.5-slfo.1.1_4.1
sssd-wbclient-devel - update to 1.16.1-150300.23.56.1
libsss_simpleifp-devel - addressed in versions 1.16.1-150300.23.56.1, 2.5.2-150400.4.40.1, 2.5.2-150500.10.39.1, 2.9.3-150600.3.28.1, 2.9.3-150700.9.9.1
python3-sss-murmur-debuginfo - addressed in versions 1.16.1-150300.23.56.1, 2.5.2-150400.4.40.1, 2.5.2-150500.10.39.1, 2.9.3-150600.3.28.1
python-sssdconfig - update to 1.16.5-10
sssd-winbind-idmap - addressed in versions 1.16.5-10, 2.9.4-3, 2.9.4-5
libsss_sudo - addressed in versions 1.16.5-10, 2.9.4-3, 2.9.4-5
sssd-ldap - addressed in versions 1.16.5-10, 2.9.4-3, 2.9.4-5
sssd-krb5-common - addressed in versions 1.16.5-10, 2.9.4-3, 2.9.4-5
sssd-krb5 - addressed in versions 1.16.5-10, 2.9.4-3, 2.9.4-5
sssd-kcm - addressed in versions 1.16.5-10, 2.9.4-3, 2.9.4-5
sssd-ipa - addressed in versions 1.16.5-10, 2.9.4-3, 2.9.4-5
sssd-dbus - addressed in versions 1.16.5-10, 2.9.4-3, 2.9.4-5
sssd-common-pac - addressed in versions 1.16.5-10, 2.9.4-3, 2.9.4-5
sssd-common - addressed in versions 1.16.5-10, 2.9.4-3, 2.9.4-5
sssd-client - addressed in versions 1.16.5-10, 2.9.4-3, 2.9.4-5
sssd-ad - addressed in versions 1.16.5-10, 2.9.4-3, 2.9.4-5
sssd - addressed in versions 1.16.5-10, 2.9.4-3, 2.9.4-5
python-sss-murmur - update to 1.16.5-10
python-sss - update to 1.16.5-10
python-libsss_nss_idmap - update to 1.16.5-10
python-libipa_hbac - update to 1.16.5-10
sssd-tools - addressed in versions 1.16.5-10, 2.9.4-3, 2.9.4-5
libsss_simpleifp-devel - update to 1.16.5-10
libsss_simpleifp - addressed in versions 1.16.5-10, 2.9.4-5
libsss_nss_idmap-devel - addressed in versions 1.16.5-10, 2.9.4-3, 2.9.4-5
libsss_nss_idmap - addressed in versions 1.16.5-10, 2.9.4-3, 2.9.4-5
libsss_idmap-devel - addressed in versions 1.16.5-10, 2.9.4-3
libsss_idmap - addressed in versions 1.16.5-10, 2.9.4-3, 2.9.4-5
libsss_certmap-devel - addressed in versions 1.16.5-10, 2.9.4-3
libsss_certmap - addressed in versions 1.16.5-10, 2.9.4-3, 2.9.4-5
libsss_autofs - addressed in versions 1.16.5-10, 2.9.4-3, 2.9.4-5
libipa_hbac-devel - addressed in versions 1.16.5-10, 2.9.4-3
libipa_hbac - addressed in versions 1.16.5-10, 2.9.4-3, 2.9.4-5
sssd-libwbclient - update to 1.16.5-10
sssd-libwbclient-devel - update to 1.16.5-10
sssd-polkit-rules - addressed in versions 1.16.5-10, 2.9.4-3, 2.9.4-5
sssd-proxy - addressed in versions 1.16.5-10, 2.9.4-3, 2.9.4-5
sssd (Red Hat package) - addressed in versions 1.16.5-10.el7_9.17, 2.2.3-20.el8_2.3, 2.4.0-9.el8_4.4, 2.9.4-5.el8_10.3, 2.9.7-4.el9_7.1
sssd - addressed in versions 2.2.2-22, 2.6.1-22, 2.9.4-15
python2-sssd - update to 2.2.2-22
python3-sssd - addressed in versions 2.2.2-22, 2.6.1-22
sssd-debuginfo - addressed in versions 2.2.2-22, 2.6.1-22, 2.9.4-15
sssd-debugsource - addressed in versions 2.2.2-22, 2.6.1-22, 2.9.4-15
sssd-devel - addressed in versions 2.2.2-22, 2.6.1-22
sssd-help - addressed in versions 2.2.2-22, 2.6.1-22, 2.9.4-15
sssd-kcm-debuginfo - addressed in versions 2.5.2-150400.4.40.1, 2.5.2-150500.10.39.1, 2.9.3-150600.3.28.1, 2.9.3-150700.9.9.1
sssd-kcm - addressed in versions 2.5.2-150400.4.40.1, 2.5.2-150500.10.39.1, 2.9.3-150600.3.28.1, 2.9.3-150700.9.9.1
sssd-debuginfo - addressed in versions 2.8.2-7.1, 2.9.3-150600.3.28.1, 2.9.3-150700.9.9.1, 2.9.5-slfo.1.1_4.1
sssd-64bit - update to 2.9.3-150600.3.28.1
sssd-64bit-debuginfo - update to 2.9.3-150600.3.28.1
sssd-32bit - addressed in versions 2.9.3-150600.3.28.1, 2.9.3-150700.9.9.1
sssd-32bit-debuginfo - addressed in versions 2.9.3-150600.3.28.1, 2.9.3-150700.9.9.1
python3-sssdconfig - addressed in versions 2.9.4-3, 2.9.4-5
python3-libipa_hbac - addressed in versions 2.9.4-3, 2.9.4-5
python3-libsss_nss_idmap - addressed in versions 2.9.4-3, 2.9.4-5
python3-sss - addressed in versions 2.9.4-3, 2.9.4-5
python3-sss-murmur - addressed in versions 2.9.4-3, 2.9.4-5
sssd-nfs-idmap - addressed in versions 2.9.4-3, 2.9.4-5
sssd-idp - addressed in versions 2.9.4-3, 2.9.4-5
sssd-common - update to 2.9.4-15
sssd-dbus - update to 2.9.4-15
sssd-common-pac - update to 2.9.4-15
python3-libsss_nss_idmap - update to 2.9.4-15
sssd-idp - update to 2.9.4-15
sssd-ipa - update to 2.9.4-15
sssd-kcm - update to 2.9.4-15
sssd-krb5 - update to 2.9.4-15
sssd-krb5-common - update to 2.9.4-15
sssd-ldap - update to 2.9.4-15
sssd-nfs-idmap - update to 2.9.4-15
libsss_idmap - update to 2.9.4-15
sssd-proxy - update to 2.9.4-15
sssd-tools - update to 2.9.4-15
libipa_hbac - update to 2.9.4-15
libipa_hbac-devel - update to 2.9.4-15
libsss_autofs - update to 2.9.4-15
libsss_certmap - update to 2.9.4-15
libsss_certmap-devel - update to 2.9.4-15
sssd-client - update to 2.9.4-15
libsss_idmap-devel - update to 2.9.4-15
libsss_nss_idmap - update to 2.9.4-15
libsss_nss_idmap-devel - update to 2.9.4-15
libsss_sudo - update to 2.9.4-15
python3-libipa_hbac - update to 2.9.4-15
python3-sss - update to 2.9.4-15
python3-sss-murmur - update to 2.9.4-15
sssd-ad - update to 2.9.4-15
sssd-winbind-idmap - update to 2.9.4-15
python3-sssdconfig - update to 2.9.4-15
sssd - addressed in versions 2.11.1-2.fc41, 2.11.1-2.fc42, 2.11.1-4.fc43
Red Hat OpenShift Container Platform - addressed in versions 4.12.84, 4.13.63, 4.14.59, 4.15.60, 4.16.54, 4.17.45, 4.18.29, 4.19.20, 4.20.6
Juniper Junos Space - update to 26.1R1 Patch V1

• https://access.redhat.com/security/cve/CVE-2025-11561
• https://blog.async.sg/kerberos-ldr
• https://bugzilla.redhat.com/show_bug.cgi?id=2402727

• Improper privilege management in System Security Services Daemon (SSSD)
• Fedora 43 update for sssd
• Fedora 42 update for sssd
• Fedora 41 update for sssd
• openEuler 24.03 LTS SP1 update for sssd
• openEuler 24.03 LTS update for sssd
• openEuler 22.03 LTS SP4 update for sssd
• openEuler 22.03 LTS SP3 update for sssd
• openEuler 20.03 LTS SP4 update for sssd
• openEuler 24.03 LTS SP2 update for sssd
• Red Hat Enterprise Linux 8 update for sssd
• Red Hat Enterprise Linux 8 update for sssd
• Red Hat Enterprise Linux 7 Extended Lifecycle Support update for sssd
• Red Hat Enterprise Linux 8 update for sssd
• Anolis OS update for sssd
• Red Hat Enterprise Linux 9 update for sssd
• Anolis OS update for sssd
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14
• SUSE update for sssd
• SUSE update for sssd
• SUSE update for sssd
• SUSE update for sssd
• SUSE update for sssd
• SUSE update for sssd
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.18
• SUSE update for sssd
• SUSE update for sssd
• Improper privilege management in Red Hat OpenShift Container Platform 4.20
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.17
• Improper privilege management in Red Hat OpenShift Container Platform 4.19
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.16
• IBM Netezza Appliance update for SSSD
• Anolis OS update for sssd
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.15
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.12
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.13
• IBM Power Hardware Management Console (HMC) update for sssd library
• Multiple vulnerabilities in Junos Space