https://bugzilla.redhat.com/show_bug.cgi?id=2402728
Bug ID: 2402728
Summary: CVE-2025-11561 sssd: SSSD default Kerberos
configuration allows privilege escalation on AD-joined
Linux systems [fedora-all]
Product: Fedora
Version: 42
Status: NEW
Whiteboard: {"flaws": ["1fb766e2-a79d-4ca8-97b7-362f32c866ca"]}
Component: sssd
Keywords: Security, SecurityTracking
Severity: high
Priority: high
Assignee: sssd-maintainers(a)lists.fedoraproject.org
Reporter: abhraj(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: abokovoy(a)redhat.com, atikhono(a)redhat.com,
lslebodn(a)redhat.com, pbrezina(a)redhat.com,
sbose(a)redhat.com, ssorce(a)redhat.com,
sssd-maintainers(a)lists.fedoraproject.org
Blocks: 2402727
Target Milestone: ---
Classification: Fedora
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability
management information. If something is wrong or missing, please contact a
member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essent…
--
You are receiving this mail because:
You are the assignee for the bug.
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2402728
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…
https://bugzilla.redhat.com/show_bug.cgi?id=2373979
Bug ID: 2373979
Summary: python3-sssdconfig packs outdated .pyc files
Product: Fedora
Version: rawhide
Status: NEW
Component: sssd
Assignee: sssd-maintainers(a)lists.fedoraproject.org
Reporter: adelton(a)fedoraproject.org
QA Contact: extras-qa(a)fedoraproject.org
CC: abokovoy(a)redhat.com, atikhono(a)redhat.com,
lslebodn(a)redhat.com, pbrezina(a)redhat.com,
sbose(a)redhat.com, ssorce(a)redhat.com,
sssd-maintainers(a)lists.fedoraproject.org
Target Milestone: ---
Classification: Fedora
Reoccurence of bug #2319608:
The /usr/lib/python3.14/site-packages/SSSDConfig/__pycache__/*.cpython-314.pyc
/usr/lib/files get regenerated when SSSDConfig module is used.
Reproducible: Always
Steps to Reproduce:
1. dnf install -y python3-sssdconfig
2. stat
/usr/lib/python3.14/site-packages/SSSDConfig/__pycache__/__init__.cpython-314.pyc
3. python3 -c 'import SSSDConfig'
4. stat
/usr/lib/python3.14/site-packages/SSSDConfig/__pycache__/__init__.cpython-314.pyc
Actual Results:
bash-5.2# stat
/usr/lib/python3.14/site-packages/SSSDConfig/__pycache__/__init__.cpython-314.pyc
File:
/usr/lib/python3.14/site-packages/SSSDConfig/__pycache__/__init__.cpython-314.pyc
Size: 59904 Blocks: 120 IO Block: 4096 regular file
Device: 0,142 Inode: 1085021 Links: 2
Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root)
Access: 2025-06-06 00:00:00.000000000 +0000
Modify: 2025-06-06 00:00:00.000000000 +0000
Change: 2025-06-20 05:52:59.146656555 +0000
Birth: 2025-06-20 05:52:59.146512950 +0000
bash-5.2# python3 -c 'import SSSDConfig'
bash-5.2# stat
/usr/lib/python3.14/site-packages/SSSDConfig/__pycache__/__init__.cpython-314.pyc
File:
/usr/lib/python3.14/site-packages/SSSDConfig/__pycache__/__init__.cpython-314.pyc
Size: 61398 Blocks: 120 IO Block: 4096 regular file
Device: 0,142 Inode: 1081628 Links: 1
Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root)
Access: 2025-06-20 05:53:34.790753836 +0000
Modify: 2025-06-20 05:53:34.792024966 +0000
Change: 2025-06-20 05:53:34.792024966 +0000
Birth: 2025-06-20 05:53:34.790753836 +0000
Expected Results:
The Size and Modify time in the second stat run should match the output from
the first one.
First found by
https://github.com/freeipa/freeipa-container/actions/runs/15771389975.
--
You are receiving this mail because:
You are the assignee for the bug.
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2373979
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…
https://bugzilla.redhat.com/show_bug.cgi?id=2388766
Bug ID: 2388766
Summary: sssd-idp package is missing libsss_idp.so
Product: Fedora
Version: 42
OS: Linux
Status: NEW
Component: sssd
Severity: medium
Assignee: sssd-maintainers(a)lists.fedoraproject.org
Reporter: trevor(a)lr90.com
QA Contact: extras-qa(a)fedoraproject.org
CC: abokovoy(a)redhat.com, atikhono(a)redhat.com,
lslebodn(a)redhat.com, pbrezina(a)redhat.com,
sbose(a)redhat.com, ssorce(a)redhat.com,
sssd-maintainers(a)lists.fedoraproject.org
Target Milestone: ---
Classification: Fedora
Description of problem:
sssd fails to start the idp module due to a missing libsss_idp.so library
[dp_module_open_lib] (0x1000): Loading module [idp] with path
[/usr/lib64/sssd/libsss_idp.so]
[dp_module_open_lib] (0x0010): Unable to load module [idp] with path
[/usr/lib64/sssd/libsss_idp.so]: /usr/lib64/sssd/libsss_idp.so: cannot open
shared object file: No such file or directory
[dp_load_module] (0x0020): Unable to create DP module.
[dp_target_init] (0x0010): Unable to load module idp
Version-Release number of selected component (if applicable):
2.11.1-1.fc42
How reproducible:
install sssd-idp, configure sssd.conf to include a domain with "id_provider =
idp" and then attempt to start the sssd service. The above was captured with
"debug_level = 9"
Inspecting the rpm does not list the required library.
bash-5.2# rpm -ql sssd-idp
/etc/krb5.conf.d/sssd_enable_idp
/usr/lib/.build-id
/usr/lib/.build-id/0b/747161a609b78de1a1470a76975794572f5bab
/usr/lib/.build-id/bb/a6be68aab1336de346ac8d41d083b59d25f42a
/usr/lib64/sssd/modules/sssd_krb5_idp_plugin.so
/usr/libexec/sssd/oidc_child
/usr/share/sssd/krb5-snippets/sssd_enable_idp
Steps to Reproduce:
1. dnf install sssd-idp
2. create /etc/sssd.conf per above
3. syetemctl start sssd
Actual results:
sssd fails to start
Expected results:
sssd starts
Additional info:
--
You are receiving this mail because:
You are on the CC list for the bug.
You are the assignee for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2388766
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…
https://bugzilla.redhat.com/show_bug.cgi?id=2375213
Bug ID: 2375213
Summary: Transition of log file ownership to sssd user/group
does not fix logrotated files, which breaks logrotate
Product: Fedora
Version: 42
OS: Linux
Status: NEW
Component: sssd
Severity: medium
Assignee: sssd-maintainers(a)lists.fedoraproject.org
Reporter: jbilling(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: abokovoy(a)redhat.com, atikhono(a)redhat.com,
lslebodn(a)redhat.com, pbrezina(a)redhat.com,
sbose(a)redhat.com, ssorce(a)redhat.com,
sssd-maintainers(a)lists.fedoraproject.org
Target Milestone: ---
Classification: Fedora
When the sssd-common package introduced a change to the permissions of the log
files in /var/log/sssd/, this was added to the RPM %postinstall scriptlet:
/usr/bin/chown -f sssd:sssd /var/log/sssd/*.log || true
(Ref: https://src.fedoraproject.org/rpms/sssd/blob/f42/f/sssd.spec#_1119 )
However, there is also a logrotate configuration in sssd-common that rotates
and compresses the log files /var/log/sssd/*.log, and it also has "su sssd
sssd" in the configuration. (Ref:
https://github.com/SSSD/sssd/blob/master/src/examples/logrotate.in)
If sssd had been running before the transition to using sssd user/groups for
log file ownership, there were several root:root owned files that had been
rotated earlier. However, logrotate can no longer rotate them because their
permissions were restricted to root and logrotate is running as sssd:sssd.
You'll get an error that looks like:
logrotate[61244]: error: unable to open /var/log/sssd/sssd_pam.log-20250511
(read-only) for compression: Permission denied
This causes the logrotate.service to error out immediately, rather than
continuing to rotate log files.
I think the glob in the rpm %post install scriptlet should be changed to
/var/log/sssd/*.log* to address this.
Reproducible: Always
--
You are receiving this mail because:
You are on the CC list for the bug.
You are the assignee for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2375213
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…
https://bugzilla.redhat.com/show_bug.cgi?id=2375570
Bug ID: 2375570
Summary: Sssd 2.11.x doesn't use Kerberos cached auth:
get_password_for_cache_auth: Unsupported auth token
type [17]
Product: Fedora
Version: 42
Hardware: x86_64
OS: Linux
Status: NEW
Component: sssd
Keywords: Regression
Severity: high
Assignee: sssd-maintainers(a)lists.fedoraproject.org
Reporter: ksuszyns(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: abokovoy(a)redhat.com, atikhono(a)redhat.com,
lslebodn(a)redhat.com, pbrezina(a)redhat.com,
sbose(a)redhat.com, ssorce(a)redhat.com,
sssd-maintainers(a)lists.fedoraproject.org
Target Milestone: ---
Classification: Fedora
After upgrading Fedora 42, the sssd has been upgraded to 2.11.0-1.fc42 and with
that, the caching of the auth broke. Without a connection to the Kerberos
server, the user can't authenticate/log in to the machine.
Downgrading to 2.10.2-3.fc42 solves the issue.
Lots of logs (hundreds of megabytes) like the following (from
/var/log/sssd/sssd_ipa.redhat.com.log):
(2025-06-23 19:06:39): [be[ipa.redhat.com]] [sbus_issue_request_done] (0x0040):
sssd.dataprovider.getAccountInfo: Error [1432158212]: SSSD is offline
and also from /var/log/sssd/sssd_nss.log:
(2025-06-23 19:06:39): [nss] [cache_req_common_process_dp_reply] (0x3f7c0):
[CID#7] CR #769: Could not get account info [1432158212]: SSSD is offline
While authentication without VPN I also see (in /var/log/sssd/sssd_pam.log):
(2025-06-23 19:05:52): [pam] [get_password_for_cache_auth] (0x0010): [CID#3]
Unsupported auth token type [17].
* ... skipping repetitive backtrace ...
(2025-06-23 19:05:52): [pam] [get_password_for_cache_auth] (0x0010): [CID#3]
Failed to get password.
* ... skipping repetitive backtrace ...
(2025-06-23 19:05:52): [pam] [pam_reply] (0x0010): [CID#3]
get_password_and_type_for_cache_auth failed.
* ... skipping repetitive backtrace ...
(2025-06-23 19:05:52): [pam] [client_send] (0x0010): [CID#3] Failed to send
data, aborting client!
Reproducible: Always
Steps to Reproduce:
1. Have a Kerberos auth setup and working both with connection and without it,
running on sssd < 2.11.0
2. Upgrade to 2.11.x
Actual Results:
Without the network connection, the auth does not work
Expected Results:
The auth should work regardless of the network connection. Credentials should
be cached.
Additional Information:
Possible upstream issue: https://github.com/SSSD/sssd/issues/7968
More info:
https://redhat-internal.slack.com/archives/C05AWLALLP6/p1749486720894889
--
You are receiving this mail because:
You are on the CC list for the bug.
You are the assignee for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2375570
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…
https://bugzilla.redhat.com/show_bug.cgi?id=2379224
Bug ID: 2379224
Summary: sssd-ad does not rotate machine account password
Product: Fedora
Version: 42
Hardware: x86_64
OS: Linux
Status: NEW
Component: sssd
Severity: high
Assignee: sssd-maintainers(a)lists.fedoraproject.org
Reporter: luca.cavana(a)cavanasystems.com
QA Contact: extras-qa(a)fedoraproject.org
CC: abokovoy(a)redhat.com, atikhono(a)redhat.com,
lslebodn(a)redhat.com, pbrezina(a)redhat.com,
sbose(a)redhat.com, ssorce(a)redhat.com,
sssd-maintainers(a)lists.fedoraproject.org
Target Milestone: ---
Classification: Fedora
Description of problem:
In a Fedora 42 machine joined to AD DS by sssd and realmd (Windows Server 2022
DCs with Server 2016 Functional Level), sssd fails to rotate the machine
account password, as dictated by:
ad_maximum_machine_account_password_age = 30 days (default configuration)
ad_machine_account_password_renewal_opts = 86400:750:300:realm (default
configuration)
Version-Release number of selected component (if applicable):
sssd-ad.x86_64 2.11.0-1.fc42
realmd.x86_64 0.17.1-15.fc42
How reproducible:
Always
Steps to Reproduce:
1. Install a Fedora 42 host, patch it and join to AD DS domain
2. Wait for the default 30 days of time to pass, or modify
ad_maximum_machine_account_password_age to shorter value
3. Monitor PasswordLastSet/msDS-KeyVersionNumber attributes in AD DS, they
never change
Actual results:
The password is never rotated.
Expected results:
The password is rotated.
Additional info:
In sssd_domain_name.log you can see sssd trying to rotate the password by
calling realm command and failing. Here is a snippet of my log:
* (2025-07-10 9:56:33): [be[corp.cavanasystems.com]]
[ad_machine_account_password_renewal_done] (0x1000): --- adcli output start---
realm discover -v [realm-name]
Discover available realm
realm join -v [-U user] realm-name
Enroll this machine in a realm
realm leave -v [-U user] [realm-name]
Unenroll this machine from a realm
realm list
List known realms
realm permit [-ax] [-R realm] user ...
Permit user logins
realm deny --all [-R realm]
Deny user logins
---adcli output end---
* (2025-07-10 9:56:33): [be[corp.cavanasystems.com]] [be_ptask_done]
(0x0400): Task [AD machine account password renewal]: finished successfully
* (2025-07-10 9:56:33): [be[corp.cavanasystems.com]] [be_ptask_schedule]
(0x0400): Task [AD machine account password renewal]: scheduling task 60
seconds from last execution time [1752134253]
* (2025-07-10 9:56:33): [be[corp.cavanasystems.com]] [child_sig_handler]
(0x1000): Waiting for child [86188].
* (2025-07-10 9:56:33): [be[corp.cavanasystems.com]] [child_sig_handler]
(0x0020): child [86188] failed with status [2].
********************** BACKTRACE DUMP ENDS HERE
*********************************
(2025-07-10 9:57:33): [be[corp.cavanasystems.com]] [child_sig_handler]
(0x0020): child [86192] failed with status [2].
* ... skipping repetitive backtrace ...
(2025-07-10 9:58:33): [be[corp.cavanasystems.com]] [child_sig_handler]
(0x0020): child [86205] failed with status [2].
* ... skipping repetitive backtrace ...
(2025-07-10 9:59:33): [be[corp.cavanasystems.com]] [child_sig_handler]
(0x0020): child [86211] failed with status [2].
* ... skipping repetitive backtrace ...
(2025-07-10 10:00:33): [be[corp.cavanasystems.com]] [child_sig_handler]
(0x0020): child [86218] failed with status [2].
* ... skipping repetitive backtrace ...
You can see it is calling the realm command to do the rotation but the latter
is returning like it is being called with the wrong parameters.
It is then retrying every minute because I've altered my configuration as such,
for debugging purposes:
ad_maximum_machine_account_password_age = 30
ad_machine_account_password_renewal_opts = 60:5
--
You are receiving this mail because:
You are the assignee for the bug.
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2379224
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…
https://bugzilla.redhat.com/show_bug.cgi?id=2372533
Bug ID: 2372533
Summary: Use `systemctl kill` in logrotate postrotate script
Product: Fedora
Version: 42
OS: Linux
Status: NEW
Component: sssd
Severity: low
Assignee: sssd-maintainers(a)lists.fedoraproject.org
Reporter: marcosfrm(a)gmail.com
QA Contact: extras-qa(a)fedoraproject.org
CC: abokovoy(a)redhat.com, atikhono(a)redhat.com,
lslebodn(a)redhat.com, pbrezina(a)redhat.com,
sbose(a)redhat.com, ssorce(a)redhat.com,
sssd-maintainers(a)lists.fedoraproject.org
Target Milestone: ---
Classification: Fedora
`systemctl kill` leverages systemd's knowledge of the daemon's main PID,
eliminating the need to rely on PID files or external tools like `killall` or
`pkill`. This ensures precise signal sending to the intended process, reducing
the risk of errors in process identification. Additionally, using `systemctl
kill` logs the signal sending in the service's journal, providing a record of
actions taken. Requires selinux-policy-41.43 or higher (see
https://bugzilla.redhat.com/show_bug.cgi?id=2369644) available as an update
for F41, F42, and Rawhide.
https://bodhi.fedoraproject.org/updates/FEDORA-2025-eb98eb9e24 (F41 -- will go
to stable in a few days)
https://bodhi.fedoraproject.org/updates/FEDORA-2025-f9f097f491 (F42 -- stable)
https://bodhi.fedoraproject.org/updates/FEDORA-2025-3db4c0ec1c (Rawhide)
The logrotate configuration snippet:
# cat /etc/logrotate.d/sssd
/var/log/sssd/*.log {
weekly
missingok
notifempty
sharedscripts
rotate 2
compress
delaycompress
su sssd sssd
postrotate
/bin/kill -HUP `cat /run/sssd/sssd.pid 2>/dev/null` 2> /dev/null ||
true
/bin/pkill -HUP sssd_kcm 2> /dev/null || true
endscript
}
In the postrotate script, kill and pkill can be replaced by:
/usr/bin/systemctl kill --signal=HUP --kill-whom=main sssd.service
sssd-kcm.service 2>/dev/null || true
Because:
# systemctl show -P MainPID sssd.service
1225
# cat /run/sssd/sssd.pid
1225
# systemctl show -P MainPID sssd-kcm.service
1447
# pgrep sssd_kcm
1447
Reproducible: Always
Additional Information:
sssd-common-2.11.0-1.fc42.x86_64
--
You are receiving this mail because:
You are on the CC list for the bug.
You are the assignee for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2372533
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…
https://bugzilla.redhat.com/show_bug.cgi?id=2372833
shane.jansen(a)gmail.com <shane.jansen(a)gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Flags|needinfo?(shane.jansen@gmai |
|l.com) |
--- Comment #15 from shane.jansen(a)gmail.com <shane.jansen(a)gmail.com> ---
The information you requested is below. I noticed an error in the Problem
Reporting tool and forwarded it to Bugzilla and was otherwise unaware of any
issue, so I'm not really able to reproduce this.
root@thenv15:~# grep "^group:" /etc/nsswitch.conf
group: files [SUCCESS=merge] sss [SUCCESS=merge] systemd
root@thenv15:~# getent -s files group sssd
sssd:x:972:
root@thenv15:~# rpm -qV sssd-client
root@thenv15:~#
--
You are receiving this mail because:
You are on the CC list for the bug.
You are the assignee for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2372833
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…
https://bugzilla.redhat.com/show_bug.cgi?id=2319608
Bug ID: 2319608
Summary: python3-sssdconfig packs outdated .pyc files
Product: Fedora
Version: rawhide
OS: Linux
Status: NEW
Component: sssd
Keywords: Regression
Severity: medium
Assignee: sssd-maintainers(a)lists.fedoraproject.org
Reporter: jpazdziora(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: abokovoy(a)redhat.com, atikhono(a)redhat.com,
lslebodn(a)redhat.com, mzidek(a)redhat.com,
pbrezina(a)redhat.com, sbose(a)redhat.com,
ssorce(a)redhat.com,
sssd-maintainers(a)lists.fedoraproject.org
Target Milestone: ---
Classification: Fedora
The /usr/lib/python3.13/site-packages/SSSDConfig/__pycache__/*.cpython-313.pyc
/usr/lib/files get regenerated when SSSDConfig module is used.
Reproducible: Always
Steps to Reproduce:
1. dnf install -y python3-sssdconfig
2. stat
/usr/lib/python3.13/site-packages/SSSDConfig/__pycache__/__init__.cpython-313.pyc
3. python3 -c 'import SSSDConfig'
4. stat
/usr/lib/python3.13/site-packages/SSSDConfig/__pycache__/__init__.cpython-313.pyc
Actual Results:
[root@0890eef375bc /]# stat
/usr/lib/python3.13/site-packages/SSSDConfig/__pycache__/__init__.cpython-313.pyc
File:
/usr/lib/python3.13/site-packages/SSSDConfig/__pycache__/__init__.cpython-313.pyc
Size: 57759 Blocks: 120 IO Block: 4096 regular file
Device: 0,109 Inode: 1226072 Links: 2
Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root)
Access: 2024-10-15 00:00:00.000000000 +0000
Modify: 2024-10-15 00:00:00.000000000 +0000
Change: 2024-10-18 09:46:42.433097566 +0000
Birth: 2024-10-18 09:46:42.432097551 +0000
[root@0890eef375bc /]# python3 -c 'import SSSDConfig'
[root@0890eef375bc /]# stat
/usr/lib/python3.13/site-packages/SSSDConfig/__pycache__/__init__.cpython-313.pyc
File:
/usr/lib/python3.13/site-packages/SSSDConfig/__pycache__/__init__.cpython-313.pyc
Size: 59402 Blocks: 120 IO Block: 4096 regular file
Device: 0,109 Inode: 1196042 Links: 1
Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root)
Access: 2024-10-18 09:47:14.646592272 +0000
Modify: 2024-10-18 09:47:14.646592272 +0000
Change: 2024-10-18 09:47:14.646592272 +0000
Birth: 2024-10-18 09:47:14.646592272 +0000
Expected Results:
The Size and Modify time in the second stat run should match the output from
the first one.
First found by
https://github.com/freeipa/freeipa-container/actions/runs/11397511703/job/3….
--
You are receiving this mail because:
You are on the CC list for the bug.
You are the assignee for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2319608
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…