CVE-2018-10852

Priority
Description
The UNIX pipe which sudo uses to contact SSSD and read the available sudo
rules from SSSD has too wide permissions, which means that anyone who can
send a message using the same raw protocol that sudo and SSSD use can read
the sudo rules available for any user. This affects versions of SSSD before
1.16.3.
Package
Source: sssd (LP Ubuntu Debian)
Upstream:needs-triage
Ubuntu 12.04 ESM (Precise Pangolin):DNE
Ubuntu 14.04 ESM (Trusty Tahr):DNE (trusty was needed)
Ubuntu 16.04 LTS (Xenial Xerus):needed
Ubuntu 18.04 LTS (Bionic Beaver):needed
Ubuntu 18.10 (Cosmic Cuttlefish):ignored (reached end-of-life)
Ubuntu 19.04 (Disco Dingo):needed
Ubuntu 19.10 (Eoan):needed
Patches:
Upstream:https://pagure.io/SSSD/sssd/c/ed90a20a0f0e936eb00d268080716c0384ffb01d
More Information

Updated: 2019-07-18 17:28:46 UTC (commit 649f8c6455205380e35ed054e9ea734222c716bb)