[Git][security-tracker-team/security-tracker][master] SSSD triagging
Bastien Roucariès (@rouca)
rouca at debian.org
Wed Nov 4 20:10:39 GMT 2026
Bastien Roucariès pushed to branch master at Debian Security Tracker / security-tracker
Commits:
62e10c6d by Bastien Roucariès at 2026-11-04T21:10:25+01:00
SSSD triagging
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -45849,9 +45849,11 @@ CVE-2026-104852 (GraphQL Tools provides utilities for building, stitching, and m
CVE-2026-104044 (A flaw was found in sssd. A local attacker can trigger a Denial of Ser ...)
- sssd <unfixed> (bug #1150238)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2478664
+ NOTE: Fixed by: https://github.com/SSSD/sssd/commit/ed02f9d3559eb306d4a0a7bd4b117ade7aa9c48f (2.14.0-beta2)
CVE-2026-104043 (A flaw was found in SSSD. A local attacker with access to the Name Ser ...)
- sssd <unfixed> (bug #1150238)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2478852
+ NOTE: Fixed by: https://github.com/SSSD/sssd/commit/df9116178c8da462406a4e9cd21b75bb9a9a95df (2.14.0-beta2)
CVE-2026-104042 (A flaw was found in sssd. A local attacker can cause a Denial of Servi ...)
- sssd <unfixed> (bug #1150238)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2478862
@@ -45859,6 +45861,8 @@ CVE-2026-104041 (A flaw was found in SSSD. An unprivileged local user can repeat
- sssd <unfixed> (bug #1150238)
[trixie] - sssd <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2478864
+ NOTE: Fixed by [1/2]: https://github.com/SSSD/sssd/commit/55b35d47caf9526e911f049f7644f848fb5661ac (2.14.0-beta2)
+ NOTE: Fixed by [2/2]: https://github.com/SSSD/sssd/commit/5b54a9cb3118ec648d29ada8a8701a1db9ad2805 (2.14.0-beta2)
CVE-2026-104040 (A flaw was found in SSSD. When configured with the Entra ID identity p ...)
- sssd <unfixed> (bug #1150238)
[trixie] - sssd <no-dsa> (Minor issue)
@@ -45867,22 +45871,28 @@ CVE-2026-104039 (A flaw was found in SSSD. A local user can cause a denial of se
- sssd <unfixed> (bug #1150238)
[trixie] - sssd <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2478956
+ NOTE: Fixed by: https://github.com/SSSD/sssd/commit/f3e65b06ccbe083dd569a6ccf8e6ad6405862852 (2.14.0-beta2)
CVE-2026-104038 (A flaw was found in sssd. A remote attacker can cause a denial of serv ...)
- sssd <unfixed> (bug #1150238)
[trixie] - sssd <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2478980
+ NOTE: Fixed by: https://github.com/SSSD/sssd/commit/db521e9e3156309256b764261ebb0343fb4a6bfd (2.14.0-beta2)
CVE-2026-104037 (A flaw was found in SSSD. A local attacker can exploit this issue by s ...)
- sssd <unfixed> (bug #1150238; unimportant)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2479030
NOTE: Negligible security impact, SSSD on Debian is socket-activated and would just restart
+ NOTE: Fixed by: https://github.com/SSSD/sssd/commit/f069803fddaea70ef73bb7bcbfe6d562e61c9272 (2.14.0-beta2)
+ NOTE: Same fix than CVE-2026-104929
CVE-2026-104036 (A flaw was found in SSSD's NFS idmap plugin. When retrieving cached us ...)
- sssd <unfixed> (bug #1150238)
[trixie] - sssd <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2479057
+ NOTE: Fixed by: https://github.com/SSSD/sssd/commit/671d224106b98952cfd1f26176759629a859509d (2.14.0-beta2)
CVE-2026-104035 (A flaw was found in SSSD. An issue in the Kerberos Credential Manager ...)
- sssd <unfixed> (bug #1150238; unimportant)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2479107
NOTE: Negligible security impact, SSSD on Debian is socket-activated and would just restart
+ NOTE: Fixed by: https://github.com/SSSD/sssd/commit/9f08547a282cb2d5f0168426416be55b7dfe9990 (2.14.0-beta2)
CVE-2026-104034 (A flaw was found in SSSD. A use-after-free vulnerability exists in the ...)
- sssd <unfixed> (bug #1150238; unimportant)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2479178
@@ -45891,22 +45901,28 @@ CVE-2026-104033 (A flaw was found in SSSD. When configured to enforce account ex
- sssd <unfixed> (bug #1150238)
[trixie] - sssd <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2479271
+ NOTE: Fixed by: https://github.com/SSSD/sssd/commit/69fde641a59e91abf2fbad6c0821579b866e40d5 (2.14.0-beta2)
CVE-2026-104032 (A flaw was found in SSSD. An unprivileged local user can repeatedly re ...)
- sssd <unfixed> (bug #1150238)
[trixie] - sssd <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2479381
+ NOTE: Fixed by: https://github.com/SSSD/sssd/commit/5d127f22ae8cadf7846ae5ab0b27efa5e732bb6f (2.14.0-beta2)
CVE-2026-104031 (A flaw was found in SSSD. In configurations where the autofs responder ...)
- sssd <unfixed> (bug #1150238)
[trixie] - sssd <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2479418
+ NOTE: Fixed by: https://github.com/SSSD/sssd/commit/7b50db5032cb4f9c17581a9710654a56a20dd527 (2.14.0-beta2)
CVE-2026-104030 (A flaw was found in sssd. This vulnerability allows a local user to ca ...)
- sssd <unfixed> (bug #1150238; unimportant)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2479429
NOTE: Negligible security impact, SSSD on Debian is socket-activated and would just restart
+ NOTE: Fixed by: https://github.com/SSSD/sssd/commit/7227f9130f19db55a9873a4104ce9a431755ef99 (2.14.0-beta2)
CVE-2026-104029 (A flaw was found in SSSD. A local attacker can exploit this vulnerabil ...)
- sssd <unfixed> (bug #1150238; unimportant)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2479444
NOTE: Negligible security impact, SSSD on Debian is socket-activated and would just restart
+ NOTE: Fixed by: https://github.com/SSSD/sssd/commit/f069803fddaea70ef73bb7bcbfe6d562e61c9272 (2.14.0-beta2)
+ NOTE: Same fix than CVE-2026-104037
CVE-2026-103546 (In MongoDB Controllers for Kubernetes, insufficient validation of Ops ...)
NOT-FOR-US: MongoDB Controllers for Kubernetes
CVE-2026-103433 (Docker Buildx Bake does not request the expected fs.read approval for ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/62e10c6d74d36f8048b3d202a35fd6a635092728
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/62e10c6d74d36f8048b3d202a35fd6a635092728
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261104/10ce8d4a/attachment.htm>
More information about the debian-security-tracker-commits
mailing list