UbuntuUpdates.org

Package "sssd-common"

Name: sssd-common

Description:

System Security Services Daemon -- common files

Latest version: 2.2.3-3ubuntu0.7
Release: focal (20.04)
Level: updates
Repository: main
Head package: sssd
Homepage: https://github.com/SSSD/sssd

Links


Download "sssd-common"


Other versions of "sssd-common" in Focal

Repository Area Version
base main 2.2.3-3
security main 2.2.3-3ubuntu0.7

Changelog

Version: 2.2.3-3ubuntu0.7 2021-09-08 15:06:19 UTC

  sssd (2.2.3-3ubuntu0.7) focal-security; urgency=medium

  * SECURITY UPDATE: shell command injection in sssctl comment
    - debian/patches/CVE-2021-3621.patch: replace system() with execvp() to
      avoid execution of user supplied command in
      src/tools/sssctl/sssctl.c, src/tools/sssctl/sssctl.h,
      src/tools/sssctl/sssctl_data.c, src/tools/sssctl/sssctl_logs.c.
    - CVE-2021-3621

 -- Marc Deslauriers <email address hidden> Wed, 18 Aug 2021 08:19:23 -0400

Source diff to previous version
CVE-2021-3621 shell command injection in sssctl

Version: 2.2.3-3ubuntu0.6 2021-07-01 11:06:29 UTC

  sssd (2.2.3-3ubuntu0.6) focal; urgency=medium

  * debian/patches/fix-gpo-MS-ADTS-compliance.patch:
    - Backport several upstream patches from 2.3.x and 2.4.x in ad_gpo
      namespaces. This makes it compliant with MS ADTS spec, which allows
      gpos to be downloaded on user login. (LP: #1933116)

Source diff to previous version
1933116 [SRU] Fix GPO support in Focal

Version: 2.2.3-3ubuntu0.4 2021-03-01 13:06:24 UTC

  sssd (2.2.3-3ubuntu0.4) focal; urgency=medium

  [ Marco Trevisan ]
  * debian/control:
    - Add missing (test) dependencies as per libcrypto usage (LP: #1905790)
    - Update Maintainer to Ubuntu devs
  * debian/rules: Compile using libcrypto as crypto backend (LP: #1905790)
  * debian/nss-database-pem-exporter: Add to sssd-common and run on postinst.
    When upgrading from previous versions (that were compiled using the NSS
    crypto backend) we need to migrate the trusted CA certificates that the
    user may have added to the SSSD's NSS system database (that defaults to
    /etc/pki/nssdb).
    To do this, and not to introduce a new dependency on libnss3-tools
    (which is not shipped by default, other than making the parsing not
    working in some scenarios) I've added a small C tool that we compile and
    install as part of the sssd-common package which is able to get all the
    trusted CA certificates for a NSS database and export them in PEM
    format.
    The nss-database-pem-exporter is then used in the postinst script where
    we now:
     1. Read the SSSD settings
     2. Convert all the certificates in the configured NSS databases
     3. Store them all, appending them to the (new) default location
        (/etc/sssd/pki/sssd_auth_ca_db.pem)
     4. Disables the configured locations if pointing to NSS dbs (needed or
        we'll leave the configuration with broken values).
    At this point nss-database-pem-exporter is then the only binary in the
    package that still depends on NSS libraries. (LP: #1905790)
  * debian/patches:
    - Get libsofthsm2 from right path for each architecture, this is now used
      for real (wasn't before) to test p11k components with libcrypto and
      p11-kit, also avoids a test build failure on armhf (LP: #1905790)

  [ Valters Jansons ]
  * Avoid sending malformed SYSLOG_IDENTIFIER to journald (LP: #1908065):
    - d/rules: Set --with-syslog=journald in override_dh_auto_configure.
    - d/p/lp-1908065-01-debug_prg_name-format.patch:
      Upstream patch to clean up program names.
    - d/p/lp-1908065-02-syslog_identifier-format.patch:
      Upstream patch to include "sssd[]" identifier in program names.
    - d/p/lp-1908065-03-remove-syslog_identifier.patch:
      Upstream patch to remove custom SYSLOG_IDENTIFIER from Journald.

 -- Marco Trevisan (Treviño) <email address hidden> Thu, 11 Feb 2021 15:31:14 -0500

Source diff to previous version
1905790 Make SSSD in 20.04 using OpenSSL and p11-kit (instead of NSS) for p11_child
1908065 Invalid SYSLOG_PID for (systemd) journal messages

Version: 2.2.3-3ubuntu0.3 2021-02-08 11:06:18 UTC

  sssd (2.2.3-3ubuntu0.3) focal; urgency=medium

  * d/apparmor-profile: Update profile. (LP: #1910611)
    - Extend read permissions to /etc/sssd/** and /etc/gss/**.
    - Add read/execute permission to /usr/libexec/sssd/*.

 -- Sergio Durigan Junior <email address hidden> Mon, 18 Jan 2021 16:30:13 -0500

Source diff to previous version
1910611 sssd startup fails when apparmor in enforcing mode

Version: 2.2.3-3ubuntu0.2 2021-01-21 18:06:18 UTC

  sssd (2.2.3-3ubuntu0.2) focal; urgency=medium

  * d/p/0003-Only-start-sssd.service-if-there-s-a-configuration-f.patch:
    Upstream patch to make sssd.service only able to start when there
    is a configuration file present. (LP: #1900642)

 -- Sergio Durigan Junior <email address hidden> Mon, 11 Jan 2021 14:33:54 -0500

1900642 sssd won't start



About   -   Send Feedback to @ubuntu_updates