Arbitrary Command Injection Affecting sssd-krb5-common package, versions <0:2.4.0-9.el8_4.2


Severity

Recommended
high

Based on CentOS security rating.

Threat Intelligence

EPSS
0.34% (73rd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Arbitrary Command Injection vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-CENTOS8-SSSDKRB5COMMON-2118582
  • published17 Aug 2021
  • disclosed16 Aug 2021

Introduced: 16 Aug 2021

CVE-2021-3621  (opens in a new tab)
CWE-77  (opens in a new tab)
CWE-78  (opens in a new tab)

How to fix?

Upgrade Centos:8 sssd-krb5-common to version 0:2.4.0-9.el8_4.2 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream sssd-krb5-common package and not the sssd-krb5-common package as distributed by Centos. See How to fix? for Centos:8 relevant fixed versions and status.

A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cache-expire subcommands. This flaw allows an attacker to trick the root user into running a specially crafted sssctl command, such as via sudo, to gain root access. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

CVSS Scores

version 3.1