openSUSE Security Update: Security update for sssd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2942-1 Rating: moderate References: #1039567 #1055123 #1061832 Cross-References: CVE-2017-12173 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for sssd provides the following fixes: Security issues fixed: - CVE-2017-12173: Fixed unsanitized input when searching in local cache database (bsc#1061832). Non security issues fixed: - Fixed a segfault issue in ldap_rfc_2307_fallback_to_local_users. (bsc#1055123) - Install /var/lib/sss/mc directory to correct sssd cache invalidation behaviour. (bsc#1039567) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1251=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1251=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libipa_hbac-devel-1.13.4-9.1 libipa_hbac0-1.13.4-9.1 libipa_hbac0-debuginfo-1.13.4-9.1 libsss_idmap-devel-1.13.4-9.1 libsss_idmap0-1.13.4-9.1 libsss_idmap0-debuginfo-1.13.4-9.1 libsss_nss_idmap-devel-1.13.4-9.1 libsss_nss_idmap0-1.13.4-9.1 libsss_nss_idmap0-debuginfo-1.13.4-9.1 libsss_sudo-1.13.4-9.1 libsss_sudo-debuginfo-1.13.4-9.1 python-ipa_hbac-1.13.4-9.1 python-ipa_hbac-debuginfo-1.13.4-9.1 python-sss_nss_idmap-1.13.4-9.1 python-sss_nss_idmap-debuginfo-1.13.4-9.1 python-sssd-config-1.13.4-9.1 python-sssd-config-debuginfo-1.13.4-9.1 sssd-1.13.4-9.1 sssd-ad-1.13.4-9.1 sssd-ad-debuginfo-1.13.4-9.1 sssd-debuginfo-1.13.4-9.1 sssd-debugsource-1.13.4-9.1 sssd-ipa-1.13.4-9.1 sssd-ipa-debuginfo-1.13.4-9.1 sssd-krb5-1.13.4-9.1 sssd-krb5-common-1.13.4-9.1 sssd-krb5-common-debuginfo-1.13.4-9.1 sssd-krb5-debuginfo-1.13.4-9.1 sssd-ldap-1.13.4-9.1 sssd-ldap-debuginfo-1.13.4-9.1 sssd-proxy-1.13.4-9.1 sssd-proxy-debuginfo-1.13.4-9.1 sssd-tools-1.13.4-9.1 sssd-tools-debuginfo-1.13.4-9.1 - openSUSE Leap 42.3 (x86_64): sssd-32bit-1.13.4-9.1 sssd-debuginfo-32bit-1.13.4-9.1 - openSUSE Leap 42.2 (i586 x86_64): libipa_hbac-devel-1.13.4-5.6.1 libipa_hbac0-1.13.4-5.6.1 libipa_hbac0-debuginfo-1.13.4-5.6.1 libsss_idmap-devel-1.13.4-5.6.1 libsss_idmap0-1.13.4-5.6.1 libsss_idmap0-debuginfo-1.13.4-5.6.1 libsss_nss_idmap-devel-1.13.4-5.6.1 libsss_nss_idmap0-1.13.4-5.6.1 libsss_nss_idmap0-debuginfo-1.13.4-5.6.1 libsss_sudo-1.13.4-5.6.1 libsss_sudo-debuginfo-1.13.4-5.6.1 python-ipa_hbac-1.13.4-5.6.1 python-ipa_hbac-debuginfo-1.13.4-5.6.1 python-sss_nss_idmap-1.13.4-5.6.1 python-sss_nss_idmap-debuginfo-1.13.4-5.6.1 python-sssd-config-1.13.4-5.6.1 python-sssd-config-debuginfo-1.13.4-5.6.1 sssd-1.13.4-5.6.1 sssd-ad-1.13.4-5.6.1 sssd-ad-debuginfo-1.13.4-5.6.1 sssd-debuginfo-1.13.4-5.6.1 sssd-debugsource-1.13.4-5.6.1 sssd-ipa-1.13.4-5.6.1 sssd-ipa-debuginfo-1.13.4-5.6.1 sssd-krb5-1.13.4-5.6.1 sssd-krb5-common-1.13.4-5.6.1 sssd-krb5-common-debuginfo-1.13.4-5.6.1 sssd-krb5-debuginfo-1.13.4-5.6.1 sssd-ldap-1.13.4-5.6.1 sssd-ldap-debuginfo-1.13.4-5.6.1 sssd-proxy-1.13.4-5.6.1 sssd-proxy-debuginfo-1.13.4-5.6.1 sssd-tools-1.13.4-5.6.1 sssd-tools-debuginfo-1.13.4-5.6.1 - openSUSE Leap 42.2 (x86_64): sssd-32bit-1.13.4-5.6.1 sssd-debuginfo-32bit-1.13.4-5.6.1 References: https://www.suse.com/security/cve/CVE-2017-12173.html https://bugzilla.suse.com/1039567 https://bugzilla.suse.com/1055123 https://bugzilla.suse.com/1061832