Bug 1656618 (CVE-2019-3811)
| Summary: | CVE-2019-3811 sssd: fallback_homedir returns '/' for empty home directories in passwd file | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Laura Pardo <lpardo> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | abhgupta, abokovoy, asn, dbaker, grajaiya, jhrozek, jokerman, lslebodn, mupadhye, mzidek, pbrezina, rharwood, sbose, ssorce, sssd-maint, sthangav, trankin, tscherf |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: |
A vulnerability was found in sssd where, if a user was configured with no home directory set, sssd would return '/' (the root directory) instead of '' (the empty string / no home directory). This could impact services that restrict the user's filesystem access to within their home directory through chroot().
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-08-06 13:20:52 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1652719, 1656619, 1659843, 1660693 | ||
| Bug Blocks: | 1652985 | ||
|
Description
Laura Pardo
2018-12-05 21:17:54 UTC
Created sssd tracking bugs for this issue: Affects: fedora-all [bug 1656619] Introduced in: https://github.com/SSSD/sssd/commit/704cc1c7 Further upstream patch: https://github.com/SSSD/sssd/commit/90f32399b4 This addresses another part of the flaw that was introduced prior to the part linked on comment 2. SSSD versions back to at least 1.14.3 are most probably affected. This flaw could impact services that restrict the user's filesystem access to within their home directory. An empty home directory field would indicate "no filesystem access", where sssd reporting it as "/" would grant full access (though still confined by unix permissions, SELinux etc). (In reply to Doran Moppert from comment #4) > Further upstream patch: > > https://github.com/SSSD/sssd/commit/90f32399b4 > > This addresses another part of the flaw that was introduced prior to the > part linked on comment 2. "Another part" ? I would hope that commit addresses it all. > SSSD versions back to at least 1.14.3 are most > probably affected. The way I read the original patch, back to 0.2.0 (so, all versions, ever) In reply to comment #6: > (In reply to Doran Moppert from comment #4) > > Further upstream patch: > > > > https://github.com/SSSD/sssd/commit/90f32399b4 > > > > This addresses another part of the flaw that was introduced prior to the > > part linked on comment 2. > > "Another part" ? I would hope that commit addresses it all. Indeed! It looks like this is actually the squashed version of the commits linked from comment#0; my apologies. > > SSSD versions back to at least 1.14.3 are most > > probably affected. > > The way I read the original patch, back to 0.2.0 (so, all versions, ever) Thanks Upstream ticket: https://pagure.io/SSSD/sssd/issue/3901 You don't do any CVE descriptions for sssd, do you? Example: https://www.samba.org/samba/security/CVE-2018-16857.html (In reply to Andreas Schneider from comment #13) > You don't do any CVE descriptions for sssd, do you? > > Example: https://www.samba.org/samba/security/CVE-2018-16857.html We normally do, I 'just' forgot to do this for this CI.. e.g. https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.org/thread/IKWCIYZ3E6ATZECU2SIWCJ22POSDTI2V/ This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2019:2177 https://access.redhat.com/errata/RHSA-2019:2177 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2019-3811 |