[CLSA-2026:1791935175] Fix CVE(s): CVE-2025-11561, CVE-2026-14474, CVE-2026-14476
Type:
security
Severity:
Important
Release date:
2026-10-13 23:46:27 UTC
Description:
* SECURITY UPDATE: Path traversal in the AD GPO provider allows writing files outside the GPO cache directory as root - debian/patches/CVE-2026-14476.patch: reject ".." components of gPCFileSysPath in ad_gpo_extract_smb_components() in src/providers/ad/ad_gpo.c and check that the resolved cache path stays inside GPO_CACHE_PATH in gpo_cache_store_file() in src/providers/ad/ad_gpo_child.c - CVE-2026-14476 * SECURITY UPDATE: Unrestricted LDAP sudo search base allows injecting sudoRole objects granting root privileges - debian/patches/CVE-2026-14474.patch: warn when ldap_sudo_search_base is not set and the whole directory tree is searched in sdap_set_config_options_with_rootdse() in src/providers/ldap/sdap.c - CVE-2026-14474 * SECURITY UPDATE: Privilege escalation via the Kerberos an2ln localauth fallback on AD/IPA clients - debian/patches/CVE-2025-11561.patch: disable the an2ln localauth plugin in the SSSD localauth plugin configuration snippet in src/util/domain_info_utils.c - CVE-2025-11561
CVEs fixed:
Updated packages:
  • libipa-hbac-dev_2.4.1-2+deb11u1+tuxcare.els3_amd64.deb
    sha:111db3cc8b4b44b5a376376e6c0a57859035efcd
  • libipa-hbac0_2.4.1-2+deb11u1+tuxcare.els3_amd64.deb
    sha:c8e948a7c5ac6186819044b243695d7289cf34cc
  • libnss-sss_2.4.1-2+deb11u1+tuxcare.els3_amd64.deb
    sha:d4414c8a9a5574ba230dfaccb444c175708cfcd7
  • libpam-sss_2.4.1-2+deb11u1+tuxcare.els3_amd64.deb
    sha:ec462343c4b1e2781aee6ec770d38c77b6e8347a
  • libsss-certmap-dev_2.4.1-2+deb11u1+tuxcare.els3_amd64.deb
    sha:e47c5c63d8ff9f219d9ab2a53995807b0428c0c4
  • libsss-certmap0_2.4.1-2+deb11u1+tuxcare.els3_amd64.deb
    sha:b620b867b50fcee6751a3072635d55e4490d4228
  • libsss-idmap-dev_2.4.1-2+deb11u1+tuxcare.els3_amd64.deb
    sha:9cb48f9285ff85dbc446f5561db2052c076fe0e3
  • libsss-idmap0_2.4.1-2+deb11u1+tuxcare.els3_amd64.deb
    sha:757d02796efc0275f87aa16b484784844dcfab46
  • libsss-nss-idmap-dev_2.4.1-2+deb11u1+tuxcare.els3_amd64.deb
    sha:d4d391ec56c3af9b192ed3f228772e366a450321
  • libsss-nss-idmap0_2.4.1-2+deb11u1+tuxcare.els3_amd64.deb
    sha:f75c0a7bdfd7b8761fc340563c687f34e90adac1
  • libsss-simpleifp-dev_2.4.1-2+deb11u1+tuxcare.els3_amd64.deb
    sha:dda6e6dbac0350f07466a8f2f064c7aa2b705f84
  • libsss-simpleifp0_2.4.1-2+deb11u1+tuxcare.els3_amd64.deb
    sha:6078a2514c6556d3cfcc14677487a033af30e141
  • libsss-sudo_2.4.1-2+deb11u1+tuxcare.els3_amd64.deb
    sha:17ddc36ce8111fda8f33c0139590f4381ef4f1e5
  • libwbclient-sssd_2.4.1-2+deb11u1+tuxcare.els3_amd64.deb
    sha:a5ecc88efab2d55251a25845c2149b01760bf562
  • libwbclient-sssd-dev_2.4.1-2+deb11u1+tuxcare.els3_amd64.deb
    sha:88dead8b95c9f280082c4641c73ad6a13d0bc9db
  • python3-libipa-hbac_2.4.1-2+deb11u1+tuxcare.els3_amd64.deb
    sha:7e7f758135f1af545a53c745e7ab71f13936cef0
  • python3-libsss-nss-idmap_2.4.1-2+deb11u1+tuxcare.els3_amd64.deb
    sha:0a497190705f81ad3bf152e56039450fbe386f29
  • python3-sss_2.4.1-2+deb11u1+tuxcare.els3_amd64.deb
    sha:095d06fe3043115efe222ea170c19ce080754eb5
  • sssd_2.4.1-2+deb11u1+tuxcare.els3_amd64.deb
    sha:6b5c64f0c46007a496736dc2b355ecda636a01eb
  • sssd-ad_2.4.1-2+deb11u1+tuxcare.els3_amd64.deb
    sha:db182e84b5605ca7e6cc74522d252d948e1d15e1
  • sssd-ad-common_2.4.1-2+deb11u1+tuxcare.els3_amd64.deb
    sha:b54b0c79b7125283df65816d39f675478c71af40
  • sssd-common_2.4.1-2+deb11u1+tuxcare.els3_amd64.deb
    sha:538fdf86659689afc052f5071b790f0c4a02e946
  • sssd-dbus_2.4.1-2+deb11u1+tuxcare.els3_amd64.deb
    sha:f029b63218aa48b47095be466c2c60d15690db9c
  • sssd-ipa_2.4.1-2+deb11u1+tuxcare.els3_amd64.deb
    sha:d1cb6672ec26c265266eb451215ca8cac5d12edb
  • sssd-kcm_2.4.1-2+deb11u1+tuxcare.els3_amd64.deb
    sha:8c1e1157a090ff54742877139736c653ba7a0e23
  • sssd-krb5_2.4.1-2+deb11u1+tuxcare.els3_amd64.deb
    sha:6c393566ee8e7f7dbae11e7f239c40a5aafed797
  • sssd-krb5-common_2.4.1-2+deb11u1+tuxcare.els3_amd64.deb
    sha:6f7efffe2ed54a20d372b1a6370922668fab6193
  • sssd-ldap_2.4.1-2+deb11u1+tuxcare.els3_amd64.deb
    sha:275695f03bc64ea50dc21c8e1889f330deabbd61
  • sssd-proxy_2.4.1-2+deb11u1+tuxcare.els3_amd64.deb
    sha:33a20840ad5642761f5dc8245bd1373d365009e9
  • sssd-tools_2.4.1-2+deb11u1+tuxcare.els3_amd64.deb
    sha:8a327ab598d9bb6bce8e7f74cb646a25d6abed76
  • libipa-hbac-dev_2.4.1-2+deb11u1+tuxcare.els3_arm64.deb
    sha:59325e1414f81a555b1fa0debefa1e6967e7da8b
  • libipa-hbac0_2.4.1-2+deb11u1+tuxcare.els3_arm64.deb
    sha:39fc3c96a2b35c6766e937ec628a449f6e118979
  • libnss-sss_2.4.1-2+deb11u1+tuxcare.els3_arm64.deb
    sha:7dec3b9cd4669ed9357ce30e5e5c08f1b4123cad
  • libpam-sss_2.4.1-2+deb11u1+tuxcare.els3_arm64.deb
    sha:1547e0cae82fcdbe53ebad49a35921174e537ad7
  • libsss-certmap-dev_2.4.1-2+deb11u1+tuxcare.els3_arm64.deb
    sha:b07bd6b6d44b1f683cf70f6214dcc981c0a5b1d2
  • libsss-certmap0_2.4.1-2+deb11u1+tuxcare.els3_arm64.deb
    sha:45753406ca8b8d1c5b6c1023d0f57a4c547124e7
  • libsss-idmap-dev_2.4.1-2+deb11u1+tuxcare.els3_arm64.deb
    sha:36de3bc2d69bcce3d909845732a8152a48ccd132
  • libsss-idmap0_2.4.1-2+deb11u1+tuxcare.els3_arm64.deb
    sha:691a5b86b217b38767eb278b05bc1ab1e0f21de4
  • libsss-nss-idmap-dev_2.4.1-2+deb11u1+tuxcare.els3_arm64.deb
    sha:0a5331e7c9c379c37b70fd77768e5226a8e5bacb
  • libsss-nss-idmap0_2.4.1-2+deb11u1+tuxcare.els3_arm64.deb
    sha:4a915e2705e2b56748f8c810dec3445ab036e222
  • libsss-simpleifp-dev_2.4.1-2+deb11u1+tuxcare.els3_arm64.deb
    sha:0e3c615511547e3eeade3aa4ed1bca8b90b40863
  • libsss-simpleifp0_2.4.1-2+deb11u1+tuxcare.els3_arm64.deb
    sha:6c554da1e3f19b51bcbea1b767a3624e40351d56
  • libsss-sudo_2.4.1-2+deb11u1+tuxcare.els3_arm64.deb
    sha:1fb4e9e7c045231eb6df897f14363bb6c4e5ae4c
  • libwbclient-sssd_2.4.1-2+deb11u1+tuxcare.els3_arm64.deb
    sha:991b0d7d0f96c1c4f3dd38d04db9f8ab93a2e2e2
  • libwbclient-sssd-dev_2.4.1-2+deb11u1+tuxcare.els3_arm64.deb
    sha:bff0bcebaff82ab22c2306a92dd1a925bc511e46
  • python3-libipa-hbac_2.4.1-2+deb11u1+tuxcare.els3_arm64.deb
    sha:6739803dbd588e048d034897d33aeb881754dfd5
  • python3-libsss-nss-idmap_2.4.1-2+deb11u1+tuxcare.els3_arm64.deb
    sha:0a91e58856d056acec3c922a1e6102c0bd812236
  • python3-sss_2.4.1-2+deb11u1+tuxcare.els3_arm64.deb
    sha:cd2ab0bb40c3661d9fec235e42a6730d03d4cdf7
  • sssd_2.4.1-2+deb11u1+tuxcare.els3_arm64.deb
    sha:a3e261716ec4240ce18c0ca7743a5d6c13e412c5
  • sssd-ad_2.4.1-2+deb11u1+tuxcare.els3_arm64.deb
    sha:bcdba14dab99ba834f310ce080be9f994e2a9dea
  • sssd-ad-common_2.4.1-2+deb11u1+tuxcare.els3_arm64.deb
    sha:804927b525cafeab93e3146f133328249bd51883
  • sssd-common_2.4.1-2+deb11u1+tuxcare.els3_arm64.deb
    sha:1ab2eb5f1f5659ffffd947b89ba8ffb75b82d70c
  • sssd-dbus_2.4.1-2+deb11u1+tuxcare.els3_arm64.deb
    sha:619093b94424d5d5d26a0ea6719e7efb457e5423
  • sssd-ipa_2.4.1-2+deb11u1+tuxcare.els3_arm64.deb
    sha:3ccbf45e08685b678a54e22d45881763e13839fe
  • sssd-kcm_2.4.1-2+deb11u1+tuxcare.els3_arm64.deb
    sha:31a98ca1e6197de8e7b7f61a74833489602b785f
  • sssd-krb5_2.4.1-2+deb11u1+tuxcare.els3_arm64.deb
    sha:4fc42ae7d5e52f822bad76fd6ada47f8bf813e46
  • sssd-krb5-common_2.4.1-2+deb11u1+tuxcare.els3_arm64.deb
    sha:65528d293f3b69cc2c4bdffed26fcef16c4f6368
  • sssd-ldap_2.4.1-2+deb11u1+tuxcare.els3_arm64.deb
    sha:3cb711c8d9397c0decb840a6c33b8d984152df6b
  • sssd-proxy_2.4.1-2+deb11u1+tuxcare.els3_arm64.deb
    sha:85f97c5a8d0e25efd6d99a8ebd51651749df6750
  • sssd-tools_2.4.1-2+deb11u1+tuxcare.els3_arm64.deb
    sha:b9b0495b17a19acb5bb36bcfe07d45109081cd39
  • libipa-hbac-dev_2.4.1-2+deb11u1+tuxcare.els3_armel.deb
    sha:a5690b33a98ee3ce6edba135a6fb19755eb0f712
  • libipa-hbac0_2.4.1-2+deb11u1+tuxcare.els3_armel.deb
    sha:6515118f8bc72d25850908196caac8af59b67df1
  • libnss-sss_2.4.1-2+deb11u1+tuxcare.els3_armel.deb
    sha:7be31796b53f7ad09a10d392dae716bc1af23bb2
  • libpam-sss_2.4.1-2+deb11u1+tuxcare.els3_armel.deb
    sha:ff84e167612fe5ecc23721dde9243976ea2f70c7
  • libsss-certmap-dev_2.4.1-2+deb11u1+tuxcare.els3_armel.deb
    sha:7f40c45d51fa87e88d48043e6671dcf60befa0b3
  • libsss-certmap0_2.4.1-2+deb11u1+tuxcare.els3_armel.deb
    sha:f8a12df19ef5f8b20222deca5c8e4f357eb011cb
  • libsss-idmap-dev_2.4.1-2+deb11u1+tuxcare.els3_armel.deb
    sha:9529376a1039f16a5a8dae67164ec4dab64ea79d
  • libsss-idmap0_2.4.1-2+deb11u1+tuxcare.els3_armel.deb
    sha:0a171a791070159ee75733dba5cad97619a7ffa4
  • libsss-nss-idmap-dev_2.4.1-2+deb11u1+tuxcare.els3_armel.deb
    sha:1c9ef73fab8fc73e421dea5f49cc79096856b3c4
  • libsss-nss-idmap0_2.4.1-2+deb11u1+tuxcare.els3_armel.deb
    sha:f26a2c288a07ad6a9b06d0f3c151c997ded95a6c
  • libsss-simpleifp-dev_2.4.1-2+deb11u1+tuxcare.els3_armel.deb
    sha:afc0e07c0944b816512efc3f037968285c5164f9
  • libsss-simpleifp0_2.4.1-2+deb11u1+tuxcare.els3_armel.deb
    sha:d5317af64f7867a66c80bbc74058540744819881
  • libsss-sudo_2.4.1-2+deb11u1+tuxcare.els3_armel.deb
    sha:04d90c3493ea738f058b47d9dae11241bb4eed30
  • libwbclient-sssd_2.4.1-2+deb11u1+tuxcare.els3_armel.deb
    sha:dd610aa4d5b0de75d38bd7381840d934875c24e4
  • libwbclient-sssd-dev_2.4.1-2+deb11u1+tuxcare.els3_armel.deb
    sha:94f29c8a24f6f6bbf06988610020f7ae33747529
  • python3-libipa-hbac_2.4.1-2+deb11u1+tuxcare.els3_armel.deb
    sha:0588a32da7c0d416bdeab42a026f4a99650905fd
  • python3-libsss-nss-idmap_2.4.1-2+deb11u1+tuxcare.els3_armel.deb
    sha:5c615ea63efc6ab659048061b133a8a163f3c2d9
  • python3-sss_2.4.1-2+deb11u1+tuxcare.els3_armel.deb
    sha:a494c7713bc1bce529c545afcd36d34e399f2146
  • sssd_2.4.1-2+deb11u1+tuxcare.els3_armel.deb
    sha:00e23e69672a914cb15d21cf2ef54c1514138e80
  • sssd-ad_2.4.1-2+deb11u1+tuxcare.els3_armel.deb
    sha:6f4fd5e96512c16886b5774d89de356de3b346e3
  • sssd-ad-common_2.4.1-2+deb11u1+tuxcare.els3_armel.deb
    sha:76bdf50bf231279be197026149a0650b2b626630
  • sssd-common_2.4.1-2+deb11u1+tuxcare.els3_armel.deb
    sha:ad41ed84c9352a79a5ea54b4db42ad46c8e114a8
  • sssd-dbus_2.4.1-2+deb11u1+tuxcare.els3_armel.deb
    sha:821acc6af03b3ce1968e62f217a0c5cd2638011c
  • sssd-ipa_2.4.1-2+deb11u1+tuxcare.els3_armel.deb
    sha:e742115a4916cb2731bb48a4481caac3929215e4
  • sssd-kcm_2.4.1-2+deb11u1+tuxcare.els3_armel.deb
    sha:7edb476168d9a67d58265c6a199867683a899019
  • sssd-krb5_2.4.1-2+deb11u1+tuxcare.els3_armel.deb
    sha:6ec53fe905e5dd53247f6cd81d77c32275e018f3
  • sssd-krb5-common_2.4.1-2+deb11u1+tuxcare.els3_armel.deb
    sha:f7b1ad2068ffe8833413d99684371da8c8466136
  • sssd-ldap_2.4.1-2+deb11u1+tuxcare.els3_armel.deb
    sha:3a61cdecd3e2c64bc32877cc0515d0bf66d20590
  • sssd-proxy_2.4.1-2+deb11u1+tuxcare.els3_armel.deb
    sha:8e20fe78f86a040fa98b567c42712037af481b30
  • sssd-tools_2.4.1-2+deb11u1+tuxcare.els3_armel.deb
    sha:a3d36ed83d4b42004eca80fa65372c1bb9da11fc
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.