https://bugzilla.redhat.com/show_bug.cgi?id=2417703
Alexey Tikhonov <atikhono(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Component|sssd |ostree
Assignee|sssd-maintainers(a)lists.fedo |walters(a)redhat.com
|raproject.org |
CC| |amurdaca(a)redhat.com,
| |coreos-sig(a)lists.fedoraproj
| |ect.org,
| |dustymabe(a)redhat.com,
| |jmarrero(a)redhat.com,
| |jonathan(a)jlebon.com,
| |miabbott(a)redhat.com,
| |travier(a)redhat.com
--- Comment #16 from Alexey Tikhonov <atikhono(a)redhat.com> ---
(In reply to Alexey Tikhonov from comment #15)
> Colin, could you please take a look at this?
Changing component for better visibility.
Please feel free to re-assign bug with explanation if this is SSSD bug.
--
You are receiving this mail because:
You are the assignee for the bug.
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2417703
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…
https://bugzilla.redhat.com/show_bug.cgi?id=2375570
Bug ID: 2375570
Summary: Sssd 2.11.x doesn't use Kerberos cached auth:
get_password_for_cache_auth: Unsupported auth token
type [17]
Product: Fedora
Version: 42
Hardware: x86_64
OS: Linux
Status: NEW
Component: sssd
Keywords: Regression
Severity: high
Assignee: sssd-maintainers(a)lists.fedoraproject.org
Reporter: ksuszyns(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: abokovoy(a)redhat.com, atikhono(a)redhat.com,
lslebodn(a)redhat.com, pbrezina(a)redhat.com,
sbose(a)redhat.com, ssorce(a)redhat.com,
sssd-maintainers(a)lists.fedoraproject.org
Target Milestone: ---
Classification: Fedora
After upgrading Fedora 42, the sssd has been upgraded to 2.11.0-1.fc42 and with
that, the caching of the auth broke. Without a connection to the Kerberos
server, the user can't authenticate/log in to the machine.
Downgrading to 2.10.2-3.fc42 solves the issue.
Lots of logs (hundreds of megabytes) like the following (from
/var/log/sssd/sssd_ipa.redhat.com.log):
(2025-06-23 19:06:39): [be[ipa.redhat.com]] [sbus_issue_request_done] (0x0040):
sssd.dataprovider.getAccountInfo: Error [1432158212]: SSSD is offline
and also from /var/log/sssd/sssd_nss.log:
(2025-06-23 19:06:39): [nss] [cache_req_common_process_dp_reply] (0x3f7c0):
[CID#7] CR #769: Could not get account info [1432158212]: SSSD is offline
While authentication without VPN I also see (in /var/log/sssd/sssd_pam.log):
(2025-06-23 19:05:52): [pam] [get_password_for_cache_auth] (0x0010): [CID#3]
Unsupported auth token type [17].
* ... skipping repetitive backtrace ...
(2025-06-23 19:05:52): [pam] [get_password_for_cache_auth] (0x0010): [CID#3]
Failed to get password.
* ... skipping repetitive backtrace ...
(2025-06-23 19:05:52): [pam] [pam_reply] (0x0010): [CID#3]
get_password_and_type_for_cache_auth failed.
* ... skipping repetitive backtrace ...
(2025-06-23 19:05:52): [pam] [client_send] (0x0010): [CID#3] Failed to send
data, aborting client!
Reproducible: Always
Steps to Reproduce:
1. Have a Kerberos auth setup and working both with connection and without it,
running on sssd < 2.11.0
2. Upgrade to 2.11.x
Actual Results:
Without the network connection, the auth does not work
Expected Results:
The auth should work regardless of the network connection. Credentials should
be cached.
Additional Information:
Possible upstream issue: https://github.com/SSSD/sssd/issues/7968
More info:
https://redhat-internal.slack.com/archives/C05AWLALLP6/p1749486720894889
--
You are receiving this mail because:
You are on the CC list for the bug.
You are the assignee for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2375570
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…
https://bugzilla.redhat.com/show_bug.cgi?id=2402728
Bug ID: 2402728
Summary: CVE-2025-11561 sssd: SSSD default Kerberos
configuration allows privilege escalation on AD-joined
Linux systems [fedora-all]
Product: Fedora
Version: 42
Status: NEW
Whiteboard: {"flaws": ["1fb766e2-a79d-4ca8-97b7-362f32c866ca"]}
Component: sssd
Keywords: Security, SecurityTracking
Severity: high
Priority: high
Assignee: sssd-maintainers(a)lists.fedoraproject.org
Reporter: abhraj(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: abokovoy(a)redhat.com, atikhono(a)redhat.com,
lslebodn(a)redhat.com, pbrezina(a)redhat.com,
sbose(a)redhat.com, ssorce(a)redhat.com,
sssd-maintainers(a)lists.fedoraproject.org
Blocks: 2402727
Target Milestone: ---
Classification: Fedora
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability
management information. If something is wrong or missing, please contact a
member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essent…
--
You are receiving this mail because:
You are the assignee for the bug.
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2402728
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…
https://bugzilla.redhat.com/show_bug.cgi?id=2372833
Alexey Tikhonov <atikhono(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Resolution|--- |INSUFFICIENT_DATA
Status|NEW |CLOSED
Last Closed| |2025-12-03 11:30:44
--
You are receiving this mail because:
You are on the CC list for the bug.
You are the assignee for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2372833