CVE-2022-4254

sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters

Score

CVSS 3.1 8.8 High

Status

Modified - secalert@redhat.com

Published

2023-02-01

Last modified

2025-03-27

Weaknesses

CWE-90

Affected products

• Sssd (Fedoraproject)
• Enterprise Linux (Redhat)
• Enterprise Linux Desktop (Redhat)
• Enterprise Linux For Ibm Z Systems (Redhat)
• Enterprise Linux For Power Big Endian (Redhat)
• Enterprise Linux For Power Little Endian (Redhat)
• Enterprise Linux For Scientific Computing (Redhat)
• Enterprise Linux Server (Redhat)
• Enterprise Linux Server Aus (Redhat)
• Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions (Redhat)
• Enterprise Linux Server Tus (Redhat)
• Enterprise Linux Server Update Services For Sap Solutions (Redhat)
• Enterprise Linux Workstation (Redhat)

References

• https://access.redhat.com/security/cve/CVE-2022-4254
• https://bugzilla.redhat.com/show_bug.cgi?id=2149894
• https://github.com/SSSD/sssd/commit/a2b9a84460429181f2a4fa7e2bb5ab49fd561274
• https://github.com/SSSD/sssd/issues/5135
• https://lists.debian.org/debian-lts-announce/2023/05/msg00028.html