-----BEGIN PGP SIGNED MESSAGE-----
Last week, the SSSD team discovered a security flaw in SSSD 1.0.0. It
has been designated CVE-2010-0014
When sssd is configured to use Kerberos for authentication
(auth_provider = krb5 in a domain section) any password is accepted as
valid when all of the following conditions are met:
- the system is offline, i.e. the KDC configured with the option
krb5_kdcip cannot be reached
- the user who tries to authenticate has a valid TGT for the Kerberos
realm served by SSSD in his credential cache file
SSSD 1.0.1 has now been released and is available at
for download immediately.
This is a serious vulnerability, and anyone using Kerberos auth
through the SSSD should update to this version as soon as possible.
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
-----END PGP SIGNATURE-----