回合上游社区补丁,补丁数量：7

<table><tbody><tr><td>软件包</td><td>commitid</td><td>描述</td><td>分析人</td></tr><tr><td>openEuler:sssd</td><td>7a8da2762897005d854cb91eaf5024986c31f8e7</td><td>ipa: Check sudo command threshold correctly

This patch should avoid Coverity warnings like:
./src/sss_client/pam_sss.c:3075:17: alloc_arg: get_authtok_for_password_change allocates memory that is stored into pi.first_factor../src/sss_client/pam_sss.c:3090:25: leaked_storage: Variable pi going out of scope leaks the storage pi.first_factor points to.

Resolves: https://github.com/SSSD/sssd/issues/7715

The copy of 'secret' argument - `secret_val.data` - was left hangingon `sss_sec_ctx`, effectively resulting in a memory leak.But this copy isn't actually required as this data isn't modified inbelow operations.Skipping alloc+memcpy+erase is also beneficial performance wise.
:fixes:'sssd_kcm' memory leak was fixed.

```...    talloc_new: src/responder/kcm/kcmsrv_ccache.c:405 contains      0 bytes in   1 blocks  0x563feaabf520...```

Originally the option ipv4_first and ipv6_first was taken into accountwhen resolving IP address.
When both families are resolvable but the primary is blocked onfirewall, the SSSD should try the secondary family before giving up.
:relnote:SSSD now attempts to connect to the server using a secondaryprotocol if the server is not reachable using the primary one.See the lookup_family_order option.

```1614            D;       9. out_of_scope: Variable buf goes out of scope.
CID 530049: 10. leaked_storage: Variable rd going out of scope leaks the storage rd.data points to.1615            return PAM_SYSTEM_ERR;1616    }```

【是否新引入rpm包，是否进行了安全编译选项扫描】

否

【定位分析】

回合补丁

<table><tbody><tr><td>软件包</td><td>commitid</td><td>描述</td></tr><tr><td>openEuler:sssd</td><td>7a8da2762897005d854cb91eaf5024986c31f8e7</td><td>ipa: Check sudo command threshold correctly

This patch should avoid Coverity warnings like:
./src/sss_client/pam_sss.c:3075:17: alloc_arg: get_authtok_for_password_change allocates memory that is stored into pi.first_factor../src/sss_client/pam_sss.c:3090:25: leaked_storage: Variable pi going out of scope leaks the storage pi.first_factor points to.
Reviewed-by: Alexey Tikhonov &lt;atikhono@redhat.com&gt;Reviewed-by: Tomáš Halman &lt;thalman@redhat.com&gt;</td></tr><tr><td>openEuler:sssd</td><td>fce94aec3f335cbe33c509b14e389b9df0748744</td><td>ldap_child: make sure invalid krb5 context is not used
Resolves: https://github.com/SSSD/sssd/issues/7715
Reviewed-by: Alejandro López &lt;allopez@redhat.com&gt;Reviewed-by: Alexey Tikhonov &lt;atikhono@redhat.com&gt;</td></tr><tr><td>openEuler:sssd</td><td>7f1b7c9689827df92e8b2166423d4e80688dbacb</td><td>KCM: fix memory leak
The copy of 'secret' argument - `secret_val.data` - was left hangingon `sss_sec_ctx`, effectively resulting in a memory leak.But this copy isn't actually required as this data isn't modified inbelow operations.Skipping alloc+memcpy+erase is also beneficial performance wise.
:fixes:'sssd_kcm' memory leak was fixed.
Reviewed-by: Alejandro López &lt;allopez@redhat.com&gt;Reviewed-by: Justin Stephenson &lt;jstephen@redhat.com&gt;</td></tr><tr><td>openEuler:sssd</td><td>9e72bc242b600158d7920b2b98644efa42fd1ffa</td><td>KCM: another memory leak fixed
```...    talloc_new: src/responder/kcm/kcmsrv_ccache.c:405 contains 0 bytes in 1 blocks  0x563feaabf520...```

Originally the option ipv4_first and ipv6_first was taken into accountwhen resolving IP address.
When both families are resolvable but the primary is blocked onfirewall, the SSSD should try the secondary family before giving up.
:relnote:SSSD now attempts to connect to the server using a secondaryprotocol if the server is not reachable using the primary one.See the lookup_family_order option.
Reviewed-by: Alejandro López &lt;allopez@redhat.com&gt;Reviewed-by: Dan Lavu &lt;dlavu@redhat.com&gt;</td></tr><tr><td>openEuler:sssd</td><td>c36c320d12e48178b041d9859e3035f0c65c4909</td><td>PAM: fix issue found by Coverity
```1614 D;       9. out_of_scope: Variable buf goes out of scope.
CID 530049: 10. leaked_storage: Variable rd going out of scope leaks the storage rd.data points to.1615 return PAM_SYSTEM_ERR;1616 }```
Reviewed-by: Justin Stephenson &lt;jstephen@redhat.com&gt;</td></tr></tbody></table>

【对外部是否有影响】

否

【是否修改引入】

<table><tbody><tr><td>该问题在当前版本是否修改引入可填写</td><td>写明引入单的DTS号并在此单关联，且立即知会版本经理或测试经理可填写</td></tr><tr><td>否</td><td>不涉及</td></tr></tbody></table>

**二、缺陷分析结构反馈**
影响性分析说明：

缺陷严重等级:(Critical/High/Moderate/Low)

缺陷根因说明:

受影响版本排查(受影响/不受影响):
openEuler-20.03-LTS-SP4
openEuler-22.03-LTS-SP3
openEuler-22.03-LTS-SP4
openEuler-24.03-LTS
openEuler-24.03-LTS-SP1
openEuler-24.03-LTS-SP2

修复是否涉及abi变化(是/否):
openEuler-20.03-LTS-SP4
openEuler-22.03-LTS-SP3
openEuler-22.03-LTS-SP4
openEuler-24.03-LTS
openEuler-24.03-LTS-SP1
openEuler-24.03-LTS-SP2

src-openEuler/sssd

Content Risk Flag

Comments (5)

src-openEuler/sssd .gitee-modal { width: 500px !important; }

Content Risk Flag