CVE-2018-16883

Severity: medium (CVSS 5.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-12-19 · updated 2026-06-17
Weakness: CWE-200

Description

sssd versions from 1.13.0 to before 2.0.0 did not properly restrict access to the infopipe according to the "allowed_uids" configuration parameter. If sensitive information were stored in the user directory, this could be inadvertently disclosed to local attackers.

Affected products

[UNKNOWN] sssd: from 1.13.0 before 2.0.0 — fixed in 2.0.0

How to fix

Upgrade to a fixed version: [UNKNOWN] sssd 2.0.0. Check the vendor advisory for mitigations.

References

http://www.securityfocus.com/bid/106264
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16883
http://www.securityfocus.com/bid/106264
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16883

Get alerted when CVE-2018-16883 or the next vulnerability affects your stack