CVE-2021-3621 - log back

CVE-2021-3621 edited at 14 Oct 2021 21:23:09
Type
- Arbitrary command execution
+ Privilege escalation
Description
- A security issue was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cache-expire subcommands. This flaw allows an attacker to trick the root user into running a specially crafted sssctl command, such as via sudo, to gain root access.
+ A security issue was found in SSSD before version 2.6.0, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cache-expire subcommands. This flaw allows an attacker to trick the root user into running a specially crafted sssctl command, such as via sudo, to gain root access.
CVE-2021-3621 edited at 23 Aug 2021 11:31:52
Severity
- Unknown
+ Medium
Remote
- Unknown
+ Local
Type
- Unknown
+ Arbitrary command execution
Description
+ A security issue was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cache-expire subcommands. This flaw allows an attacker to trick the root user into running a specially crafted sssctl command, such as via sudo, to gain root access.
References
+ https://bugzilla.redhat.com/show_bug.cgi?id=1975142
+ https://github.com/SSSD/sssd/commit/7ab83f97e1cbefb78ece17232185bdd2985f0bbe
Notes
CVE-2021-3621 created at 23 Aug 2021 11:29:56