CVE-2022-4254

Published: Feb 1, 2023Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters

Affected (14)

Products: Fedoraproject: Sssd · Redhat: Enterprise Linux, Enterprise Linux Desktop, Enterprise Linux For Ibm Z Systems, Enterprise Linux For Power Big Endian, Enterprise Linux For Power Little Endian, Enterprise Linux For Scientific Computing, Enterprise Linux Server, Enterprise Linux Server Aus, Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions, Enterprise Linux Server Tus, Enterprise Linux Server Update Services For Sap Solutions, Enterprise Linux Workstation

1 product

12 products

Enterprise Linux

Enterprise Linux Desktop

Enterprise Linux For Ibm Z Systems

Enterprise Linux For Power Big Endian

Enterprise Linux For Power Little Endian

Enterprise Linux For Scientific Computing

Enterprise Linux Server

Enterprise Linux Server Aus

Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions

Enterprise Linux Server Tus

Enterprise Linux Server Update Services For Sap Solutions

Enterprise Linux Workstation

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Sssd	From 1.15.3 to 2.3.1

Configuration B

13 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux	Version 8.0
Redhat Enterprise Linux Desktop	Version 7.0
Redhat Enterprise Linux For Ibm Z Systems	Version 7.0
Redhat Enterprise Linux For Power Big Endian	Version 7.0
Redhat Enterprise Linux For Power Little Endian	Version 7.0
Redhat Enterprise Linux For Scientific Computing	Version 7.0
Redhat Enterprise Linux Server	Version 7.0
Redhat Enterprise Linux Server Aus	Version 8.2
Redhat Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions	Version 8.1
Redhat Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions	Version 8.2
Redhat Enterprise Linux Server Tus	Version 8.2
Redhat Enterprise Linux Server Update Services For Sap Solutions	Version 8.1
Redhat Enterprise Linux Workstation	Version 7.0

Related CWEs

Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')

The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.

References (10)

https://access.redhat.com/security/cve/CVE-2022-4254

Source: secalert@redhat.com

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2149894

Source: secalert@redhat.com

ExploitIssue TrackingPatchThird Party Advisory

https://github.com/SSSD/sssd/commit/a2b9a84460429181f2a4fa7e2bb5ab49fd561274

Source: secalert@redhat.com

PatchThird Party Advisory

https://github.com/SSSD/sssd/issues/5135

Source: secalert@redhat.com

ExploitIssue TrackingPatchThird Party Advisory

https://lists.debian.org/debian-lts-announce/2023/05/msg00028.html

Source: secalert@redhat.com

https://access.redhat.com/security/cve/CVE-2022-4254

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2149894

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitIssue TrackingPatchThird Party Advisory

https://github.com/SSSD/sssd/commit/a2b9a84460429181f2a4fa7e2bb5ab49fd561274

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://github.com/SSSD/sssd/issues/5135

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitIssue TrackingPatchThird Party Advisory

https://lists.debian.org/debian-lts-announce/2023/05/msg00028.html

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.