CVE-2018-16883

sssd versions from 1.13.0 to before 2.0.0 did not properly restrict access to the infopipe according to the "allowed_uids" configuration parameter. If sensitive information were stored in the user directory, this could be inadvertently disclosed to local attackers.

Score

CVSS 3.0 5.5 Medium

Status

Modified - secalert@redhat.com

Published

2018-12-19

Last modified

2024-08-05

Weaknesses

CWE-200

Affected products

• Sssd (Fedoraproject)
• Sssd (Unknown)

References

• http://www.securityfocus.com/bid/106264
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16883