CVE-2017-12173
It was found that sssd's sysdb_search_user_by_upn_res() function before 1.16.0 did not sanitize requests when querying its local cache and was vulnera...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
It was found that sssd's sysdb_search_user_by_upn_res() function before 1.16.0 did not sanitize requests when querying its local cache and was vulnerable to injection. In a centralized login environment, if a password hash was locally cached for a given user, an authenticated attacker could use this flaw to retrieve it.
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2017-12173 sssd Corrigé dans: 1.15.3-2
Références
- advisory access.redhat.com
- advisory access.redhat.com
- patch bugzilla.redhat.com