LDAP injection in System Security Services Daemon (SSSD) - CVE-2022-4254

Vulnerability identifier: #VU71473

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-4254

CWE-ID: CWE-90

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to improper input validation in libsss_certmap functionality when validating data used in DLAP queries. A remote non-authenticated attacker can use a specially crafted certificate to bypass authentication process and gain control of the admin account, leading to full domain takeover.

System Security Services Daemon (SSSD)
Amazon Linux AMI
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Linux Enterprise Micro
openSUSE Leap Micro
SUSE Enterprise Storage
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
CentOS
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Realtime Extension
Ubuntu
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
sssd-krb5-debuginfo
sssd-dbus-debuginfo
sssd-debuginfo
sssd-debuginfo-32bit
sssd-debugsource
sssd-ipa
sssd-ipa-debuginfo
sssd-krb5
sssd-krb5-common
sssd-krb5-common-debuginfo
sssd-dbus
sssd-ldap
sssd-ldap-debuginfo
sssd-proxy
sssd-proxy-debuginfo
sssd-tools
sssd-tools-debuginfo
libsss_nss_idmap-devel
libsss_idmap-devel
sssd-ad-debuginfo
libipa_hbac0
libipa_hbac0-debuginfo
libsss_certmap0
libsss_certmap0-debuginfo
libsss_idmap0
libsss_idmap0-debuginfo
libsss_nss_idmap0
libsss_nss_idmap0-debuginfo
libsss_simpleifp0
libsss_simpleifp0-debuginfo
python-sssd-config
python-sssd-config-debuginfo
sssd
sssd-32bit
sssd-ad
sssd-common-debuginfo-32bit
libipa_hbac-devel
sssd-common
sssd-common-32bit
sssd-common-debuginfo
sssd-wbclient
sssd-wbclient-debuginfo
sssd-wbclient-devel
sssd-winbind-idmap
sssd-winbind-idmap-debuginfo
sssd-32bit-debuginfo
python3-sssd-config-debuginfo
libsss_certmap-devel
libsss_simpleifp-devel
python3-sssd-config
sssd-common-32bit-debuginfo
sssd (Red Hat package)
sssd (Ubuntu package)
Session Smart Router
XtremIO X2
EMC Cloud Tiering Appliance
IBM Qradar SIEM

Install updates from vendor's website.

System Security Services Daemon (SSSD) - update to 2.3.1
sssd-krb5-debuginfo - addressed in versions 1.16.1-4.43.1, 1.16.1-7.49.1, 1.16.1-150000.8.70.1, 1.16.1-150200.17.26.1, 1.16.1-150300.23.37.1
sssd-dbus-debuginfo - addressed in versions 1.16.1-4.43.1, 1.16.1-7.49.1, 1.16.1-150000.8.70.1, 1.16.1-150200.17.26.1, 1.16.1-150300.23.37.1
sssd-debuginfo - addressed in versions 1.16.1-4.43.1, 1.16.1-150000.8.70.1
sssd-debuginfo-32bit - update to 1.16.1-4.43.1
sssd-debugsource - addressed in versions 1.16.1-4.43.1, 1.16.1-7.49.1, 1.16.1-150000.8.70.1, 1.16.1-150200.17.26.1, 1.16.1-150300.23.37.1
sssd-ipa - addressed in versions 1.16.1-4.43.1, 1.16.1-7.49.1, 1.16.1-150000.8.70.1, 1.16.1-150200.17.26.1, 1.16.1-150300.23.37.1
sssd-ipa-debuginfo - addressed in versions 1.16.1-4.43.1, 1.16.1-7.49.1, 1.16.1-150000.8.70.1, 1.16.1-150200.17.26.1, 1.16.1-150300.23.37.1
sssd-krb5 - addressed in versions 1.16.1-4.43.1, 1.16.1-7.49.1, 1.16.1-150000.8.70.1, 1.16.1-150200.17.26.1, 1.16.1-150300.23.37.1
sssd-krb5-common - addressed in versions 1.16.1-4.43.1, 1.16.1-7.49.1, 1.16.1-150000.8.70.1, 1.16.1-150200.17.26.1, 1.16.1-150300.23.37.1
sssd-krb5-common-debuginfo - addressed in versions 1.16.1-4.43.1, 1.16.1-7.49.1, 1.16.1-150000.8.70.1, 1.16.1-150200.17.26.1, 1.16.1-150300.23.37.1
sssd-dbus - addressed in versions 1.16.1-4.43.1, 1.16.1-7.49.1, 1.16.1-150000.8.70.1, 1.16.1-150200.17.26.1, 1.16.1-150300.23.37.1
sssd-ldap - addressed in versions 1.16.1-4.43.1, 1.16.1-7.49.1, 1.16.1-150000.8.70.1, 1.16.1-150200.17.26.1, 1.16.1-150300.23.37.1
sssd-ldap-debuginfo - addressed in versions 1.16.1-4.43.1, 1.16.1-7.49.1, 1.16.1-150000.8.70.1, 1.16.1-150200.17.26.1, 1.16.1-150300.23.37.1
sssd-proxy - addressed in versions 1.16.1-4.43.1, 1.16.1-7.49.1, 1.16.1-150000.8.70.1, 1.16.1-150200.17.26.1, 1.16.1-150300.23.37.1
sssd-proxy-debuginfo - addressed in versions 1.16.1-4.43.1, 1.16.1-7.49.1, 1.16.1-150000.8.70.1, 1.16.1-150200.17.26.1, 1.16.1-150300.23.37.1
sssd-tools - addressed in versions 1.16.1-4.43.1, 1.16.1-7.49.1, 1.16.1-150000.8.70.1, 1.16.1-150200.17.26.1, 1.16.1-150300.23.37.1
sssd-tools-debuginfo - addressed in versions 1.16.1-4.43.1, 1.16.1-7.49.1, 1.16.1-150000.8.70.1, 1.16.1-150200.17.26.1, 1.16.1-150300.23.37.1
libsss_nss_idmap-devel - addressed in versions 1.16.1-4.43.1, 1.16.1-7.49.1, 1.16.1-150000.8.70.1, 1.16.1-150200.17.26.1, 1.16.1-150300.23.37.1
libsss_idmap-devel - addressed in versions 1.16.1-4.43.1, 1.16.1-7.49.1, 1.16.1-150000.8.70.1, 1.16.1-150200.17.26.1, 1.16.1-150300.23.37.1
sssd-ad-debuginfo - addressed in versions 1.16.1-4.43.1, 1.16.1-7.49.1, 1.16.1-150000.8.70.1, 1.16.1-150200.17.26.1, 1.16.1-150300.23.37.1
libipa_hbac0 - addressed in versions 1.16.1-4.43.1, 1.16.1-7.49.1, 1.16.1-150000.8.70.1, 1.16.1-150200.17.26.1, 1.16.1-150300.23.37.1
libipa_hbac0-debuginfo - addressed in versions 1.16.1-4.43.1, 1.16.1-7.49.1, 1.16.1-150000.8.70.1, 1.16.1-150200.17.26.1, 1.16.1-150300.23.37.1
libsss_certmap0 - addressed in versions 1.16.1-4.43.1, 1.16.1-7.49.1, 1.16.1-150000.8.70.1, 1.16.1-150200.17.26.1, 1.16.1-150300.23.37.1
libsss_certmap0-debuginfo - addressed in versions 1.16.1-4.43.1, 1.16.1-7.49.1, 1.16.1-150000.8.70.1, 1.16.1-150200.17.26.1, 1.16.1-150300.23.37.1
libsss_idmap0 - addressed in versions 1.16.1-4.43.1, 1.16.1-7.49.1, 1.16.1-150000.8.70.1, 1.16.1-150200.17.26.1, 1.16.1-150300.23.37.1
libsss_idmap0-debuginfo - addressed in versions 1.16.1-4.43.1, 1.16.1-7.49.1, 1.16.1-150000.8.70.1, 1.16.1-150200.17.26.1, 1.16.1-150300.23.37.1
libsss_nss_idmap0 - addressed in versions 1.16.1-4.43.1, 1.16.1-7.49.1, 1.16.1-150000.8.70.1, 1.16.1-150200.17.26.1, 1.16.1-150300.23.37.1
libsss_nss_idmap0-debuginfo - addressed in versions 1.16.1-4.43.1, 1.16.1-7.49.1, 1.16.1-150000.8.70.1, 1.16.1-150200.17.26.1, 1.16.1-150300.23.37.1
libsss_simpleifp0 - addressed in versions 1.16.1-4.43.1, 1.16.1-7.49.1, 1.16.1-150000.8.70.1, 1.16.1-150200.17.26.1, 1.16.1-150300.23.37.1
libsss_simpleifp0-debuginfo - addressed in versions 1.16.1-4.43.1, 1.16.1-7.49.1, 1.16.1-150000.8.70.1, 1.16.1-150200.17.26.1, 1.16.1-150300.23.37.1
python-sssd-config - addressed in versions 1.16.1-4.43.1, 1.16.1-7.49.1
python-sssd-config-debuginfo - addressed in versions 1.16.1-4.43.1, 1.16.1-7.49.1
sssd - addressed in versions 1.16.1-4.43.1, 1.16.1-7.49.1, 1.16.1-150000.8.70.1, 1.16.1-150200.17.26.1, 1.16.1-150300.23.37.1
sssd-32bit - addressed in versions 1.16.1-4.43.1, 1.16.1-150000.8.70.1
sssd-ad - addressed in versions 1.16.1-4.43.1, 1.16.1-7.49.1, 1.16.1-150000.8.70.1, 1.16.1-150200.17.26.1, 1.16.1-150300.23.37.1
sssd-common-debuginfo-32bit - update to 1.16.1-7.49.1
libipa_hbac-devel - addressed in versions 1.16.1-7.49.1, 1.16.1-150000.8.70.1, 1.16.1-150200.17.26.1, 1.16.1-150300.23.37.1
sssd-common - addressed in versions 1.16.1-7.49.1, 1.16.1-150200.17.26.1, 1.16.1-150300.23.37.1
sssd-common-32bit - addressed in versions 1.16.1-7.49.1, 1.16.1-150200.17.26.1, 1.16.1-150300.23.37.1
sssd-common-debuginfo - addressed in versions 1.16.1-7.49.1, 1.16.1-150200.17.26.1, 1.16.1-150300.23.37.1
sssd-wbclient - update to 1.16.1-150000.8.70.1
sssd-wbclient-debuginfo - update to 1.16.1-150000.8.70.1
sssd-wbclient-devel - update to 1.16.1-150000.8.70.1
sssd-winbind-idmap - addressed in versions 1.16.1-150000.8.70.1, 1.16.1-150200.17.26.1, 1.16.1-150300.23.37.1
sssd-winbind-idmap-debuginfo - addressed in versions 1.16.1-150000.8.70.1, 1.16.1-150200.17.26.1, 1.16.1-150300.23.37.1
sssd-32bit-debuginfo - update to 1.16.1-150000.8.70.1
python3-sssd-config-debuginfo - addressed in versions 1.16.1-150000.8.70.1, 1.16.1-150200.17.26.1, 1.16.1-150300.23.37.1
libsss_certmap-devel - addressed in versions 1.16.1-150000.8.70.1, 1.16.1-150200.17.26.1, 1.16.1-150300.23.37.1
libsss_simpleifp-devel - addressed in versions 1.16.1-150000.8.70.1, 1.16.1-150200.17.26.1, 1.16.1-150300.23.37.1
python3-sssd-config - addressed in versions 1.16.1-150000.8.70.1, 1.16.1-150200.17.26.1, 1.16.1-150300.23.37.1
sssd-common-32bit-debuginfo - addressed in versions 1.16.1-150200.17.26.1, 1.16.1-150300.23.37.1
sssd - update to 1.16.4-21.27
sssd (Red Hat package) - addressed in versions 1.16.5-10.el7_9.15, 2.2.0-19.el8_1.3, 2.2.3-20.el8_2.2
sssd (Ubuntu package) - update to 2.2.3-3ubuntu0.11
Session Smart Router - update to 6.2.3-r2
XtremIO X2 - update to 6.4.2-13
IBM Qradar SIEM - addressed in versions 7.4.3 Fix Pack 9, 7.5.0 Update Pack 5
EMC Cloud Tiering Appliance - update to 13.2.0.2.22

• https://bugzilla.redhat.com/show_bug.cgi?id=2149894

• Authentication bypass in SSSD
• Red Hat Enterprise Linux 8 update for sssd
• Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions update for sssd
• Red Hat Enterprise Linux 7 update for sssd
• SUSE update for sssd
• SUSE update for sssd
• CentOS 7 update for sssd
• SUSE update for sssd
• SUSE update for sssd
• SUSE update for sssd
• Amazon Linux AMI update for sssd
• Multiple vulnerabilities in Dell Cloud Tiering Appliance
• Ubuntu update for sssd
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in Juniper Networks Session Smart Router
• Multiple vulnerabilities in Dell XtremIO X2