SSSD CVE-2018-16883 Local Information Disclosure Vulnerability

Bugtraq ID:	106264
Class:	Access Validation Error
CVE:	CVE-2018-16883
Remote:	No
Local:	Yes
Published:	Dec 19 2018 12:00AM
Updated:	Dec 19 2018 12:00AM
Credit:	Christian Heimes
Vulnerable:	Redhat Enterprise Linux 7 Redhat Enterprise Linux 6 + Trustix Secure Enterprise Linux 2.0 + Trustix Secure Linux 2.2 + Trustix Secure Linux 2.1 + Trustix Secure Linux 2.0 Fedoraproject Sssd 1.16.3 Fedoraproject Sssd 1.16.2 Fedoraproject Sssd 1.16 Fedoraproject Sssd 1.15.3 Fedoraproject Sssd 1.15.2 Fedoraproject Sssd 1.15.1 Fedoraproject Sssd 1.15 Fedoraproject Sssd 1.14.2 Fedoraproject Sssd 1.14.1 Fedoraproject Sssd 1.14 Fedoraproject Sssd 1.13
Not Vulnerable:	Fedoraproject Sssd 2.0

SSSD CVE-2018-16883 Local Information Disclosure Vulnerability

SSSD is prone to local information-disclosure vulnerability.

An attacker can exploit this issue to gain access to sensitive information that may aid in further attacks.

SSSD CVE-2018-16883 Local Information Disclosure Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

SSSD CVE-2018-16883 Local Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

SSSD CVE-2018-16883 Local Information Disclosure Vulnerability

References:

• Bug 1659862 (CVE-2018-16883) - CVE-2018-16883 sssd: Information leak in infopipe (Red Hat Bugzilla)
  
• CVE-2018-16883 (Red Hat Bugzilla)
  
• SSSD Homepage (Fedora)