It was found that sssd's sysdb_search_user_by_upn_res() function before 1.16.0 did not sanitize requests when querying its local cache and was vulnerable to injection. In a centralized login environment, if a password hash was locally cached for a given user, an authenticated attacker could use this flaw to retrieve it.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: redhat
Published: 2018-07-27T16:00:00
Updated: 2024-08-05T18:28:16.645Z
Reserved: 2017-08-01T00:00:00
Link: CVE-2017-12173
Vulnrichment
No data.
NVD
Status : Modified
Published: 2018-07-27T16:29:00.257
Modified: 2024-11-21T03:08:59.020
Link: CVE-2017-12173
Redhat