CVE-2023-3758

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-3758
A race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated users. This may lead to improper authorization issues, granting or denying access to resources inappropriately.

7.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector ADJACENT_NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://access.redhat.com/errata/RHSA-2024:1919
https://access.redhat.com/errata/RHSA-2024:1920
https://access.redhat.com/errata/RHSA-2024:1921
https://access.redhat.com/errata/RHSA-2024:1922
https://access.redhat.com/errata/RHSA-2024:2571
https://access.redhat.com/errata/RHSA-2024:3270
https://access.redhat.com/security/cve/CVE-2023-3758
https://bugzilla.redhat.com/show_bug.cgi?id=2223762
https://github.com/SSSD/sssd/pull/7302
https://access.redhat.com/errata/RHSA-2024:1919
https://access.redhat.com/errata/RHSA-2024:1920
https://access.redhat.com/errata/RHSA-2024:1921
https://access.redhat.com/errata/RHSA-2024:1922
https://access.redhat.com/errata/RHSA-2024:2571
https://access.redhat.com/errata/RHSA-2024:3270
https://access.redhat.com/security/cve/CVE-2023-3758
https://bugzilla.redhat.com/show_bug.cgi?id=2223762
https://github.com/SSSD/sssd/pull/7302
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RV3HIZI3SURBUQKSOOL3XE64OOBQ2HTK/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XEP62IDS7A55D5UHM6GH7QZ7SQFOAPVF/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XMORAO2BDDA5YX4ZLMXDZ7SM6KU47SY5/
Configurations

No configuration.

History

24 Nov 2024, 16:15

Type Values Removed Values Added
CWE CWE-285 CWE-362

21 Nov 2024, 08:17

Type Values Removed Values Added
References
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RV3HIZI3SURBUQKSOOL3XE64OOBQ2HTK/ -
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XEP62IDS7A55D5UHM6GH7QZ7SQFOAPVF/ -
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XMORAO2BDDA5YX4ZLMXDZ7SM6KU47SY5/ -
References () https://access.redhat.com/errata/RHSA-2024:1919 - () https://access.redhat.com/errata/RHSA-2024:1919 -
References () https://access.redhat.com/errata/RHSA-2024:1920 - () https://access.redhat.com/errata/RHSA-2024:1920 -
References () https://access.redhat.com/errata/RHSA-2024:1921 - () https://access.redhat.com/errata/RHSA-2024:1921 -
References () https://access.redhat.com/errata/RHSA-2024:1922 - () https://access.redhat.com/errata/RHSA-2024:1922 -
References () https://access.redhat.com/errata/RHSA-2024:2571 - () https://access.redhat.com/errata/RHSA-2024:2571 -
References () https://access.redhat.com/errata/RHSA-2024:3270 - () https://access.redhat.com/errata/RHSA-2024:3270 -
References () https://access.redhat.com/security/cve/CVE-2023-3758 - () https://access.redhat.com/security/cve/CVE-2023-3758 -
References () https://bugzilla.redhat.com/show_bug.cgi?id=2223762 - () https://bugzilla.redhat.com/show_bug.cgi?id=2223762 -
References () https://github.com/SSSD/sssd/pull/7302 - () https://github.com/SSSD/sssd/pull/7302 -

16 Sep 2024, 19:16

Type Values Removed Values Added
References
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RV3HIZI3SURBUQKSOOL3XE64OOBQ2HTK/', 'source': 'secalert@redhat.com'}
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XEP62IDS7A55D5UHM6GH7QZ7SQFOAPVF/', 'source': 'secalert@redhat.com'}
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XMORAO2BDDA5YX4ZLMXDZ7SM6KU47SY5/', 'source': 'secalert@redhat.com'}

22 May 2024, 18:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2024:3270 -

08 May 2024, 03:15

Type Values Removed Values Added
References
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XMORAO2BDDA5YX4ZLMXDZ7SM6KU47SY5/ -

08 May 2024, 02:15

Type Values Removed Values Added
References
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XEP62IDS7A55D5UHM6GH7QZ7SQFOAPVF/ -

30 Apr 2024, 20:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2024:2571 -

25 Apr 2024, 06:15

Type Values Removed Values Added
References
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RV3HIZI3SURBUQKSOOL3XE64OOBQ2HTK/ -

19 Apr 2024, 13:10

Type Values Removed Values Added
Summary
  • (es) Se encontró una falla en la condición de ejecución en sssd donde la política de GPO no se aplica de manera consistente para los usuarios autenticados. Esto puede dar lugar a problemas de autorización inapropiados, otorgando o denegando acceso a recursos de manera inapropiada.

18 Apr 2024, 19:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-04-18 19:15

Updated : 2025-02-06 17:15

NVD link : CVE-2023-3758

Mitre link : CVE-2023-3758

CVE.ORG link : CVE-2023-3758

JSON object : View

Products Affected

No product.

CWE
CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')