Security update for sssd

Announcement ID:	SUSE-SU-2024:1577-1
Rating:	important
References:	bsc#1160688 bsc#1223100 jsc#PED-7677 jsc#SLE-9298
Cross-References:	CVE-2023-3758
CVSS scores:	CVE-2023-3758 ( SUSE ): 7.1 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products:	SUSE Linux Enterprise High Performance Computing 12 SP5 SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE Linux Enterprise Software Development Kit 12 SP5

An update that solves one vulnerability, contains two features and has one security fix can now be installed.

Description:

This update for sssd fixes the following issues:

Security fixes: - CVE-2023-3758: Fixed race condition during authorization that lead to GPO policies functioning inconsistently (bsc#1223100)

Other fixes:

Extend sssctl command line tool to manage the cached GPOs (jsc#PED-7677)
SSSD GPO host entries are ignored if computer cn does not match it's samaccountname (jsc#SLE-9298) (bsc#1160688)
SSSD should accept host entries from GPO's security filter (jsc#SLE-9298)

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

SUSE Linux Enterprise High Performance Computing 12 SP5
zypper in -t patch SUSE-SLE-SERVER-12-SP5-2024-1577=1
SUSE Linux Enterprise Server 12 SP5
zypper in -t patch SUSE-SLE-SERVER-12-SP5-2024-1577=1
SUSE Linux Enterprise Server for SAP Applications 12 SP5
zypper in -t patch SUSE-SLE-SERVER-12-SP5-2024-1577=1
SUSE Linux Enterprise Software Development Kit 12 SP5
zypper in -t patch SUSE-SLE-SDK-12-SP5-2024-1577=1

Package List:

SUSE Linux Enterprise High Performance Computing 12 SP5 (aarch64 x86_64)
- sssd-common-1.16.1-7.61.1
- sssd-common-debuginfo-1.16.1-7.61.1
- sssd-tools-1.16.1-7.61.1
- python-sssd-config-1.16.1-7.61.1
- sssd-dbus-1.16.1-7.61.1
- sssd-tools-debuginfo-1.16.1-7.61.1
- sssd-ipa-1.16.1-7.61.1
- libsss_idmap0-debuginfo-1.16.1-7.61.1
- sssd-krb5-common-debuginfo-1.16.1-7.61.1
- libsss_nss_idmap0-debuginfo-1.16.1-7.61.1
- sssd-1.16.1-7.61.1
- libsss_certmap0-debuginfo-1.16.1-7.61.1
- sssd-ad-debuginfo-1.16.1-7.61.1
- libsss_simpleifp0-debuginfo-1.16.1-7.61.1
- sssd-krb5-1.16.1-7.61.1
- sssd-debugsource-1.16.1-7.61.1
- libipa_hbac0-debuginfo-1.16.1-7.61.1
- sssd-ipa-debuginfo-1.16.1-7.61.1
- sssd-proxy-debuginfo-1.16.1-7.61.1
- sssd-proxy-1.16.1-7.61.1
- sssd-krb5-common-1.16.1-7.61.1
- libsss_simpleifp0-1.16.1-7.61.1
- libipa_hbac0-1.16.1-7.61.1
- sssd-dbus-debuginfo-1.16.1-7.61.1
- python-sssd-config-debuginfo-1.16.1-7.61.1
- sssd-krb5-debuginfo-1.16.1-7.61.1
- sssd-ldap-1.16.1-7.61.1
- libsss_certmap0-1.16.1-7.61.1
- sssd-ad-1.16.1-7.61.1
- sssd-ldap-debuginfo-1.16.1-7.61.1
- libsss_nss_idmap0-1.16.1-7.61.1
- libsss_idmap0-1.16.1-7.61.1
SUSE Linux Enterprise High Performance Computing 12 SP5 (aarch64)
- libsss_nss_idmap-devel-1.16.1-7.61.1
SUSE Linux Enterprise High Performance Computing 12 SP5 (x86_64)
- sssd-common-debuginfo-32bit-1.16.1-7.61.1
- sssd-common-32bit-1.16.1-7.61.1
SUSE Linux Enterprise Server 12 SP5 (aarch64 ppc64le s390x x86_64)
- sssd-common-1.16.1-7.61.1
- sssd-common-debuginfo-1.16.1-7.61.1
- sssd-tools-1.16.1-7.61.1
- python-sssd-config-1.16.1-7.61.1
- sssd-dbus-1.16.1-7.61.1
- sssd-tools-debuginfo-1.16.1-7.61.1
- sssd-ipa-1.16.1-7.61.1
- libsss_idmap0-debuginfo-1.16.1-7.61.1
- sssd-krb5-common-debuginfo-1.16.1-7.61.1
- libsss_nss_idmap0-debuginfo-1.16.1-7.61.1
- sssd-1.16.1-7.61.1
- libsss_certmap0-debuginfo-1.16.1-7.61.1
- sssd-ad-debuginfo-1.16.1-7.61.1
- libsss_simpleifp0-debuginfo-1.16.1-7.61.1
- sssd-krb5-1.16.1-7.61.1
- sssd-debugsource-1.16.1-7.61.1
- libipa_hbac0-debuginfo-1.16.1-7.61.1
- sssd-ipa-debuginfo-1.16.1-7.61.1
- sssd-proxy-debuginfo-1.16.1-7.61.1
- sssd-proxy-1.16.1-7.61.1
- sssd-krb5-common-1.16.1-7.61.1
- libsss_simpleifp0-1.16.1-7.61.1
- libipa_hbac0-1.16.1-7.61.1
- sssd-dbus-debuginfo-1.16.1-7.61.1
- python-sssd-config-debuginfo-1.16.1-7.61.1
- sssd-krb5-debuginfo-1.16.1-7.61.1
- sssd-ldap-1.16.1-7.61.1
- libsss_certmap0-1.16.1-7.61.1
- sssd-ad-1.16.1-7.61.1
- sssd-ldap-debuginfo-1.16.1-7.61.1
- libsss_nss_idmap0-1.16.1-7.61.1
- libsss_idmap0-1.16.1-7.61.1
SUSE Linux Enterprise Server 12 SP5 (aarch64)
- libsss_nss_idmap-devel-1.16.1-7.61.1
SUSE Linux Enterprise Server 12 SP5 (s390x x86_64)
- sssd-common-debuginfo-32bit-1.16.1-7.61.1
- sssd-common-32bit-1.16.1-7.61.1
SUSE Linux Enterprise Server for SAP Applications 12 SP5 (ppc64le x86_64)
- sssd-common-1.16.1-7.61.1
- sssd-common-debuginfo-1.16.1-7.61.1
- sssd-tools-1.16.1-7.61.1
- python-sssd-config-1.16.1-7.61.1
- sssd-dbus-1.16.1-7.61.1
- sssd-tools-debuginfo-1.16.1-7.61.1
- sssd-ipa-1.16.1-7.61.1
- libsss_idmap0-debuginfo-1.16.1-7.61.1
- sssd-krb5-common-debuginfo-1.16.1-7.61.1
- libsss_nss_idmap0-debuginfo-1.16.1-7.61.1
- sssd-1.16.1-7.61.1
- libsss_certmap0-debuginfo-1.16.1-7.61.1
- sssd-ad-debuginfo-1.16.1-7.61.1
- libsss_simpleifp0-debuginfo-1.16.1-7.61.1
- sssd-krb5-1.16.1-7.61.1
- sssd-debugsource-1.16.1-7.61.1
- libipa_hbac0-debuginfo-1.16.1-7.61.1
- sssd-ipa-debuginfo-1.16.1-7.61.1
- sssd-proxy-debuginfo-1.16.1-7.61.1
- sssd-proxy-1.16.1-7.61.1
- sssd-krb5-common-1.16.1-7.61.1
- libsss_simpleifp0-1.16.1-7.61.1
- libipa_hbac0-1.16.1-7.61.1
- sssd-dbus-debuginfo-1.16.1-7.61.1
- python-sssd-config-debuginfo-1.16.1-7.61.1
- sssd-krb5-debuginfo-1.16.1-7.61.1
- sssd-ldap-1.16.1-7.61.1
- libsss_certmap0-1.16.1-7.61.1
- sssd-ad-1.16.1-7.61.1
- sssd-ldap-debuginfo-1.16.1-7.61.1
- libsss_nss_idmap0-1.16.1-7.61.1
- libsss_idmap0-1.16.1-7.61.1
SUSE Linux Enterprise Server for SAP Applications 12 SP5 (x86_64)
- sssd-common-debuginfo-32bit-1.16.1-7.61.1
- sssd-common-32bit-1.16.1-7.61.1
SUSE Linux Enterprise Software Development Kit 12 SP5 (aarch64 ppc64le s390x x86_64)
- libipa_hbac-devel-1.16.1-7.61.1
- libsss_nss_idmap-devel-1.16.1-7.61.1
- libsss_idmap-devel-1.16.1-7.61.1
- sssd-debugsource-1.16.1-7.61.1

Security update for sssd

Description:

Patch Instructions:

Package List:

References: