CVE-2021-3621

 

Published at: - 23-12-2021 10:15

Last modified: - 24-10-2022 06:38

Total changes: - 4

Description

A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cache-expire subcommands. This flaw allows an attacker to trick the root user into running a specially crafted sssctl command, such as via sudo, to gain root access. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

 

Verification logic

 

Reference

• https://sssd.io/release-notes/sssd-2.6.0.html
• https://bugzilla.redhat.com/show_bug.cgi?id=1975142

 

Keywords

NVD

 

CVE-2021-3621

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures