Public bug reported:
A new release of sssd is available for merging from Debian.
Ubuntu: 2.12.0-4ubuntu4
Debian Unstable: 2.13.1-3
### New Debian Changes ###
sssd (2.13.1-3) unstable; urgency=medium
* debian/tests/control: Explicitly have tests requiring openssh-client depend
on it. (See openssh Debian bug #699473, resolved since openssh 1:10.3p1-6).
This should resolve currently failing autopkgtests.
-- Mike Gabriel <[email protected]> Tue, 08 Sep 2026 13:05:35 +0200
sssd (2.13.1-2) unstable; urgency=medium
* debian/patches: Add CVE-2026-68742.diff, CVE-2026-68743.diff, and CVE-
2026-68744.diff. (Closes: #1143600, #1143947).
CVE-2026-68742: nss: validate addrlen in sss_nss_protocol_parse_addr()
CVE-2026-68743: pam: validate auth_token_length in extract_authtok_v1()
CVE-2026-68744: NSS: fix initgroups packet heap disclosure
-- Mike Gabriel <[email protected]> Fri, 04 Sep 2026 15:54:27 +0200
sssd (2.13.1-1) unstable; urgency=medium
* Team upload.
[ Timo Aaltonen ]
* New upstream release.
- CVE-2026-6245: pam: fix out-of-bounds read in pam_passkey_child_read_data.
(Closes: #1134269).
* patches: Drop upstreamed patch.
* source: Update diff-ignore.
* control: Change maintainer address.
[ Mike Gabriel ]
* debian/patches:
+ Update fix-whitespace-test.diff. Add logic to ignore various code files
during the whitespace tests
+ Add fix-ftbfs-src-m4.patch. Fix FTBFS due to missing src/m4 Makefile
target.
+ Add fix-underlinking-keyutils.patch. Assure that unit tests that reference
headers from libkeyutils-dev get linked against the library.
+ Add fix-eol-flaws-in-codefiles.patch. Fix EOL and EOF issue in one file to
make whitespace_test unit test happy.
+ CVE-2026-12610: Add CVE-2026-12610.diff. PAM: fix use-after-free during
p11_child processing. (Closes: #1141323).
+ CVE-2026-14474, CVE-2026-14476: Add CVE-2026-14474.diff (sudo: warn when
ldap_sudo_search_base falls back to root DN) and CVE-2026-14476.diff (gpo:
reject path traversal in gPCFileSysPath. (Closes: #1141769).
-- Mike Gabriel <[email protected]> Thu, 03 Sep 2026 12:16:27 +0200
### Old Ubuntu Delta ###
sssd (2.12.0-4ubuntu4) stonking; urgency=medium
[ Maizi Liao ]
* d/p/lp2169162-fix-use-after-free-in-kcm_read_options.patch
fix use-after-free in kcm_read_options(). The `renew_intv`
string was allocated under tmp_ctx but not re-linked to
mem_ctx before tmp_ctx was freed. (LP: #2169162)
-- Maizi Liao <[email protected]> Tue, 06 Oct 2026 13:31:49
+0000
sssd (2.12.0-4ubuntu3) stonking; urgency=medium
* d/p/fix-ldap-child-zombie.patch: fix zombie ldap_child process
(LP: #2164856)
-- Andreas Hasenack <[email protected]> Tue, 22 Sep 2026
11:12:57 -0300
sssd (2.12.0-4ubuntu2) stonking; urgency=medium
* SECURITY UPDATE: Denial of Service
- debian/patches/CVE-2026-68743.patch: pam: validate auth_token_length in
extract_authtok_v1() in src/responder/pam/pamsrv_cmd.c.
- CVE-2026-68743
-- John Breton <[email protected]> Wed, 02 Sep 2026 11:03:11
-0400
sssd (2.12.0-4ubuntu1) stonking; urgency=medium
* Merge with Debian unstable (LP: #2153174). Remaining changes:
- d/control: Drop libgdm-dev Build-Depend on i386.
- d/control: Don't build sssd-tools on i386, now uninstallable due
to added python3-{click,systemd} dependencies.
- Do not run as root (LP #2139337):
+ d/rules: use --with-sssd-user=sssd
+ d/rules: install tmpfiles.d/sssd.conf for pid file
+ d/rules: install udev rules
+ d/sssd-postinst-permission-extract: new spec -> postinst convert tool
+ d/sssd-{common,ipa,krb5-common,proxy}.postinst: set correct state
directory permissions for sssd user
+ d/t/sssd-softhism2-certificates-tests: don't recreate existing user
+ d/t/sssd-smart-card-pam-auth-configs-tester: adjust permissions for
running sssd without root
+ d/t/sssd-smart-card-pam-auth-configs-tester: fix enabling incompatible
pam configs at once
- d/sssd-common.{pre,post}inst: stop services while changing root-less
permissions (LP #2142140)
- d/t/util: remove obsolete sssd.conf config_file_version
- d/p/krb5_kpasswd_loglevel: fix missing krb5_kpasswd logging as crash
(LP #2146334)
[Added the patch to d/p/series so that it is really applied this time]
- libsss-sudo: ensure 'files' is present in nsswitch.conf sudoers line
(LP #2151950)
+ d/libsss-sudo.nss: add 'files' with skip-if-present=files so fresh
installs get 'sudoers: files sss'
+ d/libsss-sudo.postinst: add custom snippet to prepend 'files' on
upgrade from broken versions that only had 'sudoers: sss'
- d/sssd-common.postinst: also set capabilities for helper binaries
from other packages, if they are present (LP #2155002)
* New changes:
- Add OpenSSL 4 compatibility: (LP: #2154894)
+ d/p/openssl4-fixes/x400Address-type-check.patch: correct x400Address
type check in crypto.m4
+ d/p/openssl4-fixes/update-certmap.patch: update certmap for OpenSSL 4.0
compatibility
+ d/p/openssl4-fixes/add-const-qualifiers.patch: add const qualifier to
X509_NAME pointers
- d/p/lp2162577-fix-use-after-free-during-p11-child-processing.patch: fix
sssd_pam crash when authenticating with slow smartcards (LP: #2162577)
[CVE-2026-12610]
- d/p/gdm-51-pam-extension-macros-compat.patch: replace uppercase
macros for functions for GDM 51 compatibility (LP: #2163336)
* Dropped changes:
- d/t/sssd-{softhism2-certificates-test,smart-card-pam-auth-configs-tester}:
fix test user creation
[ Included in Debian version 2.12.0-2 ]
- d/t/sssd-smart-card-pam-auth-configs-tester: remove deprecated files
provider
[ Included in Debian version 2.12.0-2 ]
- libsss-sudo: Drop dependency on libnss-sudo, modify libsss-sudo.nss to
create the nsswitch.conf entry for sudo. (Closes: #770825)
[ Included in Debian version 2.12.0-2 ]
- Adapt B-D for ding-libs>=0.7.0
[ Included in Debian version 2.12.0-3~exp0 ]
- Fix FTBFS with ding-libs>=0.7.0 (patch from upstream)
[ Included in Debian version 2.12.0-3~exp0 ]
-- Renan Rodrigo <[email protected]> Wed, 12 Aug 2026 15:08:36 -0300
** Affects: sssd (Ubuntu)
Importance: Wishlist
Status: New
** Tags: needs-merge upgrade-software-version
** Changed in: sssd (Ubuntu)
Importance: Undecided => Wishlist
** Changed in: sssd (Ubuntu)
Milestone: None => ubuntu-26.11
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2171158
Title:
Merge sssd 2.13.1-3 from Debian for tenacious cycle
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/sssd/+bug/2171158/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
