sssd experts,

On ~Dec 14th, CVE-2020-1472 was reported against RHEL7.  It's a samba vulnerability.  Among the very many vulnerable RPMs identified in the errata, they list samba-client-libs RPM.

The sssd-ad RPM has an RPM dependency on this samba-client-libs RPM.  I believe the sssd-ad RPM is the RPM that provides the sssd backend to integrate with AD.  Thus, if we remove sssd-ad RPM, I believe we'll break our current direct AD integration with sssd.

I'm trying to gauge our exposure.  As documented exploits using this CVE are allegedly being seen in the wild, MITRE is rating this CVE as a 100. But I question that -- for our environment.

We directly integrate our RHEL7 and 8 clients to AD.  Our AD DCs are true Windows domain controllers.  

As I understand it, our exposure should be minimal or none because:
1. This CVE is mainly for if you run a Samba server as an AD DC (we do not), and
2. Since we directly integrate to AD from our sssd clients, I'm not sure that any code in this
   samba-client-libs RPM ever gets exercised.

Comments?

I realize this CVE will be remediated in our next Linux patch cycle (~mid-Jan).  But I'm not sure all companies are as pro-active.

Spike