Hi,

The following vulnerabilities were published for sssd.

CVE-2026-14474[0]:
| A flaw was found in SSSD's LDAP sudo provider. When the
| ldap_sudo_search_base option is not explicitly configured, SSSD
| searches the entire LDAP directory tree for sudoRole objects. An
| authenticated attacker with write access to any subtree can inject a
| sudoRole object granting root-level sudo privileges on all SSSD-
| enrolled hosts.


CVE-2026-14476[1]:
| A path traversal flaw was found in SSSD's AD GPO provider. The
| ad_gpo_extract_smb_components() function does not sanitize ..
| sequences in the gPCFileSysPath LDAP attribute, allowing an attacker
| with AD GPO management access to write files outside the GPO cache
| directory as root. On default RHEL configurations with SELinux
| enforcing, this can be used to inject Kerberos configuration leading
| to authentication bypass.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-14474
https://www.cve.org/CVERecord?id=CVE-2026-14474
[1] https://security-tracker.debian.org/tracker/CVE-2026-14476
https://www.cve.org/CVERecord?id=CVE-2026-14476

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Hi,

I would like to do an NMU to fix this/these bug(s). Patches exist in
upstream github repo. I'll pick those patches.

CVE-2026-68744: https://github.com/SSSD/sssd/pull/9217
CVE-2026-68743: https://github.com/SSSD/sssd/pull/9215
CVE-2026-68742: https://github.com/SSSD/sssd/pull/9216
CVE-2026-14476: https://github.com/SSSD/sssd/pull/8907
CVE-2026-14474: https://github.com/SSSD/sssd/pull/8897

Cheers,

Hi Luke,

please hold back the NMU for the time being.  for the time being. There
is a new team forming to maintain sssd in the future. A Salsa MR would
be appreciated though, if forking the repository works for you.

Did I just see you in the "new DD" list? If so, welcome to the project.
That being said, I'd not want to start my DD career with an NMU of a
seucrity relevant package.

Please consider subscribing to the sssd package in the tracker so that
you get all relevant communication.

Greetings
Marc

Hi,

I see Mike G. (?) already did a team upload which covers what I wanted
to do, so I'll drop this NMU.

Just a new DM, but I'll take your welcome ;) I was only trying to get
sssd back to testing, as I've been using sssd for years. (I have more
questions for you in PM)

Done.

Cheers,

We believe that the bug you reported is fixed in the latest version of
sssd, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1141769@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Mike Gabriel <sunweaver@debian.org> (supplier of updated sssd package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Thu, 03 Sep 2026 12:16:27 +0200
Source: sssd
Architecture: source
Version: 2.13.1-1
Distribution: unstable
Urgency: medium
Maintainer: Debian SSSD Team <sssd@packages.debian.org>
Changed-By: Mike Gabriel <sunweaver@debian.org>
Closes: 1134269 1141323 1141769
Changes:
 sssd (2.13.1-1) unstable; urgency=medium
 .
   * Team upload.
 .
   [ Timo Aaltonen ]
   * New upstream release.
     - CVE-2026-6245: pam: fix out-of-bounds read in pam_passkey_child_read_data.
       (Closes: #1134269).
   * patches: Drop upstreamed patch.
   * source: Update diff-ignore.
   * control: Change maintainer address.
 .
   [ Mike Gabriel ]
   * debian/patches:
     + Update fix-whitespace-test.diff. Add logic to ignore various code files
       during the whitespace tests
     + Add fix-ftbfs-src-m4.patch. Fix FTBFS due to missing src/m4 Makefile
       target.
     + Add fix-underlinking-keyutils.patch. Assure that unit tests that reference
       headers from libkeyutils-dev get linked against the library.
     + Add fix-eol-flaws-in-codefiles.patch. Fix EOL and EOF issue in one file to
       make whitespace_test unit test happy.
     + CVE-2026-12610: Add CVE-2026-12610.diff. PAM: fix use-after-free during
       p11_child processing. (Closes: #1141323).
     + CVE-2026-14474, CVE-2026-14476: Add CVE-2026-14474.diff (sudo: warn when
       ldap_sudo_search_base falls back to root DN) and CVE-2026-14476.diff (gpo:
       reject path traversal in gPCFileSysPath. (Closes: #1141769).
Checksums-Sha1:
 e5d89185a6a6c43c8b1077bbc8532900769f57d6 5165 sssd_2.13.1-1.dsc
 d4510a8875a5183e2d1cbea8b24b35e984959e05 9136618 sssd_2.13.1.orig.tar.gz
 92f49083de70833ade28ca7df834dfbb5b0236ec 833 sssd_2.13.1.orig.tar.gz.asc
 a981092002c731374610204bda13674acab0a3c9 53120 sssd_2.13.1-1.debian.tar.xz
 58f1e29b1174c0931b1e507f8b4edb63714382c3 19490 sssd_2.13.1-1_source.buildinfo
Checksums-Sha256:
 0109edd80074c9ab53a85f6d76d6de92762ab2ddcab7ce6d508eb4f53d712518 5165 sssd_2.13.1-1.dsc
 05ea79e89f0be399983925b8874ac196d6dc5fd4416f83609557b9fc8ef798b5 9136618 sssd_2.13.1.orig.tar.gz
 aa199860656563065819cedd3aa0b217ae6ce357a6c2c3311ba0b68fcb9cdcab 833 sssd_2.13.1.orig.tar.gz.asc
 e4dde2863bf4d7c2017cf7142a16bda3059d501720ad4143961f941a57ae0eb8 53120 sssd_2.13.1-1.debian.tar.xz
 26f73d73706a240dfad2ec4425d34314b7d5d2a54dbaa9e4c3dc63d6af7d8eb5 19490 sssd_2.13.1-1_source.buildinfo
Files:
 b933a4c0017e1657c0c672e769ab1dbc 5165 utils optional sssd_2.13.1-1.dsc
 f5e1d4554e28560059b4ffd551a668d9 9136618 utils optional sssd_2.13.1.orig.tar.gz
 a08da1bfe5734a8d103c55134e2909b7 833 utils optional sssd_2.13.1.orig.tar.gz.asc
 0ba01f5cce64c2b1a0de4bc84a9eadc6 53120 utils optional sssd_2.13.1-1.debian.tar.xz
 ff09e976b315b02c36984f1072d6a7bd 19490 utils optional sssd_2.13.1-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQJJBAEBCgAzFiEEm/uu6GwKpf+/IgeCmvRrMCV3GzEFAmqZTFYVHHN1bndlYXZl
ckBkZWJpYW4ub3JnAAoJEJr0azAldxsxZLQP/jjd6uICH8BE7JZjDbZJrS1OqzFI
JWq+bzHfbKwz910d4FmIop/aY7dp3+n8Nenih0wYvuDzxqdQgEyjwAiY5ua8vp9a
D2T2PO/4JZLoF2vABv54q4ztt7Tm501ho73jrR8mMcO7z88/f+W2KXMNY1Ok3ybp
0/eQiNrR5gOHbDoQI23AjcRBdCuRwOYvuLnp0rM09rVTK8rLYWQI7dBbOrfzf+DY
VaagIoytr3C/mXBNbyHJg875qdzZ88dyI90otxRfBLW7nupK9EMkA8CRM3wtnsKP
SpmyirxpsNXhnbj3601eUw8CTdYh/bBGLTou4o0eS3gAiM9+PNGLdlsePFadxZYG
YWGoz3EjJkGzASbTBVIn5Ebap1KW5st5WqMUKZGBFPyVivHTJiuujst1bvhrdO2J
XQMa7CxPG0IuXQWqwE/VV7821LMSVPxmh2qb0T2b/SFa8pW7jnocuiCb0QCU7CJ2
4RcV1vWtGIMUGULOpxKza96e1Vzzp//cR5rcbzJ0fJ8CqVRfITD9G6hnXqxxd+uJ
B3b5H8cgstTn2by7Gn+tPgijU5RbvsloQLwyy6STWcLwZc+eGDbrMj7P85m0MgVD
GlMG6/9x6uhBLg3Uc/C51D+edpq0wk+enLv0Fn/9sDVAP5S7H1W0bp6YvjwOYN2G
rVQxeWS9ImYHW3Kb
=Z886
-----END PGP SIGNATURE-----