CVE-2015-5292

SSSD 1.10-1.13.0 - Authenticated Denial of Service via PAC Responder Plugin

Title source: llm
STIX 2.1

Description

Memory leak in the Privilege Attribute Certificate (PAC) responder plugin (sssd_pac_plugin.so) in System Security Services Daemon (SSSD) 1.10 before 1.13.1 allows remote authenticated users to cause a denial of service (memory consumption) via a large number of logins that trigger parsing of PAC blobs during Kerberos authentication.

References (13)

Core 13
Core References
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2015-2355.html
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2015-2019.html
Vendor Advisory mailing-list x_refsource_mlist
http://permalink.gmane.org/gmane.linux.redhat.sssd.user/3422
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1034038
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/77529
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169613.html
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169110.html
Issue Tracking x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=1267580
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169597.html
Various Sources x_refsource_confirm
https://fedorahosted.org/sssd/ticket/2803
Third Party Advisory x_refsource_confirm
https://fedorahosted.org/sssd/wiki/Releases/Notes-1.13.1

Scores

EPSS 0.0367
EPSS Percentile 88.5%

Details

CWE
CWE-399
Status published
Products (17)
fedoraproject/sssd 1.10.0
fedoraproject/sssd 1.10.1
fedoraproject/sssd 1.11.0
fedoraproject/sssd 1.11.1
fedoraproject/sssd 1.11.2
fedoraproject/sssd 1.11.3
fedoraproject/sssd 1.11.4
fedoraproject/sssd 1.11.5
fedoraproject/sssd 1.11.6
fedoraproject/sssd 1.11.7
... and 7 more
Published Oct 29, 2015
Tracked Since Feb 18, 2026