An issue was found in SSSD. The default option for fallback_homedir returns '/' for empty home directories in the passwd file. References: https://github.com/SSSD/sssd/pull/703 Upstream Patch: https://github.com/SSSD/sssd/pull/703/commits/fa0a6400ebd2f4056a057914355ec2ddefc14fe6 https://github.com/SSSD/sssd/pull/703/commits/fe11bd0d5b7dea9f1723c5a59ba0c47641802797
Created sssd tracking bugs for this issue: Affects: fedora-all [bug 1656619]
Introduced in: https://github.com/SSSD/sssd/commit/704cc1c7
Further upstream patch: https://github.com/SSSD/sssd/commit/90f32399b4 This addresses another part of the flaw that was introduced prior to the part linked on comment 2. SSSD versions back to at least 1.14.3 are most probably affected.
This flaw could impact services that restrict the user's filesystem access to within their home directory. An empty home directory field would indicate "no filesystem access", where sssd reporting it as "/" would grant full access (though still confined by unix permissions, SELinux etc).
(In reply to Doran Moppert from comment #4) > Further upstream patch: > > https://github.com/SSSD/sssd/commit/90f32399b4 > > This addresses another part of the flaw that was introduced prior to the > part linked on comment 2. "Another part" ? I would hope that commit addresses it all. > SSSD versions back to at least 1.14.3 are most > probably affected. The way I read the original patch, back to 0.2.0 (so, all versions, ever)
In reply to comment #6: > (In reply to Doran Moppert from comment #4) > > Further upstream patch: > > > > https://github.com/SSSD/sssd/commit/90f32399b4 > > > > This addresses another part of the flaw that was introduced prior to the > > part linked on comment 2. > > "Another part" ? I would hope that commit addresses it all. Indeed! It looks like this is actually the squashed version of the commits linked from comment#0; my apologies. > > SSSD versions back to at least 1.14.3 are most > > probably affected. > > The way I read the original patch, back to 0.2.0 (so, all versions, ever) Thanks
Upstream ticket: https://pagure.io/SSSD/sssd/issue/3901
You don't do any CVE descriptions for sssd, do you? Example: https://www.samba.org/samba/security/CVE-2018-16857.html
(In reply to Andreas Schneider from comment #13) > You don't do any CVE descriptions for sssd, do you? > > Example: https://www.samba.org/samba/security/CVE-2018-16857.html We normally do, I 'just' forgot to do this for this CI.. e.g. https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.org/thread/IKWCIYZ3E6ATZECU2SIWCJ22POSDTI2V/
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2019:2177 https://access.redhat.com/errata/RHSA-2019:2177
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2019-3811