CVE-2017-7488

authconfig: Information leak when SSSD is used for authentication against remote server

Loading…

Severity

Moderate

Red Hat Product Security

5.3

CVSS 3.0

Review impact separately from score.

Published · May 9, 2017

Updated · May 13, 2026

Description

A flaw was found where authconfig could configure sssd in a way that treats existing and non-existing logins differently, leaking information on existence of a user. An attacker with physical or network access to the machine could enumerate users via a timing attack.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

Possible workaround (with side-effects): authconfig --enablesysnetauth --update

CVSS / CWE

CVSS 3.0 · 5.3
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor