Privilege Escalation Vulnerability in SSSD Packages - Important Security Update
Summary
ALSA-2025:21020: Important: sssd security update. Affects libipa_hbac versions < 2.11.1-2.el10_1.1. Fixed in 2.11.1-2.el10_1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The System Security Services Daemon (SSSD) is a crucial service that manages access to remote directories and authentication mechanisms in Linux systems. It integrates with various account sources and provides interfaces like Name Service Switch (NSS) and Pluggable Authentication Modules (PAM). This vulnerability affects SSSD's default Kerberos configuration, which can lead to privilege escalation on Active Directory (AD)-joined Linux systems.
Vulnerability Detail
The vulnerability identified as CVE-2025-11561 allows an attacker to exploit the default Kerberos configuration in SSSD. This misconfiguration can lead to unauthorized privilege escalation, enabling attackers to gain elevated access rights on systems that are joined to Active Directory. The implications of this vulnerability are significant, as it can compromise the security integrity of affected systems, allowing unauthorized users to perform actions that should be restricted.
How To Fix
Minimum fixed version
2.11.1-2.el10_1.1
This is the first release that contains the fix.
sudo dnf update libipa_hbacTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that your Kerberos configuration is not using the default settings. Review and modify the Kerberos settings in your SSSD configuration to mitigate the risk until the package can be updated.
Conclusion
The SSSD vulnerability CVE-2025-11561 poses a significant risk of privilege escalation on AD-joined Linux systems. It is crucial to update the affected packages to the patched version to mitigate this risk. Additionally, users should consider reviewing their Kerberos configurations as a temporary workaround.
See every vulnerability recorded for libipa_hbac →
FAQ
CVE-2025-11561 is a vulnerability in the SSSD package that allows privilege escalation due to misconfiguration in the default Kerberos settings.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to unauthorized privilege escalation, allowing attackers to gain elevated access rights on AD-joined Linux systems.
You can update the affected packages using the command: sudo dnf update <package_names>, replacing <package_names> with the relevant package names listed in the 'how_to_fix' section.
Yes, the permanent fix is to update the affected packages to version 2.11.1-2.el10_1.1 or later.
Related vulnerabilities
Recent vulnerabilities recorded for libipa_hbac.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.