CVE-2018-16838

Severity: medium (CVSS 5.4 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-03-25 · updated 2026-06-17
Weakness: CWE-284

Description

A flaw was found in sssd Group Policy Objects implementation. When the GPO is not readable by SSSD due to a too strict permission settings on the server side, SSSD will allow all authenticated users to login instead of denying access.

Affected products

[UNKNOWN] sssd: all versions
Red Hat Enterprise Linux: 7.0

References

http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00042.html
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00051.html
https://access.redhat.com/errata/RHSA-2019:2177
https://access.redhat.com/errata/RHSA-2019:2437
https://access.redhat.com/errata/RHSA-2019:3651
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16838
https://lists.debian.org/debian-lts-announce/2023/05/msg00028.html
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00042.html
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00051.html
https://access.redhat.com/errata/RHSA-2019:2177
https://access.redhat.com/errata/RHSA-2019:2437
https://access.redhat.com/errata/RHSA-2019:3651

Get alerted when CVE-2018-16838 or the next vulnerability affects your stack