openSUSE Security Update: Recommended update for adcli, sssd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1174-1 Rating: moderate References: #1109849 #1110121 #1121759 #1125617 #1127670 Cross-References: CVE-2019-3811 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves one vulnerability and has four fixes is now available. Description: This update for adcli and sssd provides the following improvement: Security vulnerability fixed: - CVE-2019-3811: Fix fallback_homedir returning '/' for empty home directories (bsc#1121759) Other fixes: - Add an option to disable checking for trusted domains in the subdomains provider (bsc#1125617) - Clear pid file in corner cases (bsc#1127670) - Fix child unable to write to log file after SIGHUP (bsc#1127670) - Include adcli in SUSE Linux Enterprise 12 SP3 for sssd-ad. (fate#326619, bsc#1109849) The adcli enables sssd to do password renewal when using Active Directory. This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1174=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libipa_hbac-devel-1.13.4-15.1 libipa_hbac0-1.13.4-15.1 libipa_hbac0-debuginfo-1.13.4-15.1 libsss_idmap-devel-1.13.4-15.1 libsss_idmap0-1.13.4-15.1 libsss_idmap0-debuginfo-1.13.4-15.1 libsss_nss_idmap-devel-1.13.4-15.1 libsss_nss_idmap0-1.13.4-15.1 libsss_nss_idmap0-debuginfo-1.13.4-15.1 libsss_sudo-1.13.4-15.1 libsss_sudo-debuginfo-1.13.4-15.1 python-ipa_hbac-1.13.4-15.1 python-ipa_hbac-debuginfo-1.13.4-15.1 python-sss_nss_idmap-1.13.4-15.1 python-sss_nss_idmap-debuginfo-1.13.4-15.1 python-sssd-config-1.13.4-15.1 python-sssd-config-debuginfo-1.13.4-15.1 sssd-1.13.4-15.1 sssd-ad-1.13.4-15.1 sssd-ad-debuginfo-1.13.4-15.1 sssd-debuginfo-1.13.4-15.1 sssd-debugsource-1.13.4-15.1 sssd-ipa-1.13.4-15.1 sssd-ipa-debuginfo-1.13.4-15.1 sssd-krb5-1.13.4-15.1 sssd-krb5-common-1.13.4-15.1 sssd-krb5-common-debuginfo-1.13.4-15.1 sssd-krb5-debuginfo-1.13.4-15.1 sssd-ldap-1.13.4-15.1 sssd-ldap-debuginfo-1.13.4-15.1 sssd-proxy-1.13.4-15.1 sssd-proxy-debuginfo-1.13.4-15.1 sssd-tools-1.13.4-15.1 sssd-tools-debuginfo-1.13.4-15.1 - openSUSE Leap 42.3 (x86_64): sssd-32bit-1.13.4-15.1 sssd-debuginfo-32bit-1.13.4-15.1 References: https://www.suse.com/security/cve/CVE-2019-3811.html https://bugzilla.suse.com/1109849 https://bugzilla.suse.com/1110121 https://bugzilla.suse.com/1121759 https://bugzilla.suse.com/1125617 https://bugzilla.suse.com/1127670