From ba3bfbb09468f0907246a6f1810429c8c672a5d7 Mon Sep 17 00:00:00 2001 From: tomcruiseqi <10762123+tomcruiseqi@user.noreply.gitee.com> Date: Sat, 1 Nov 2025 18:16:04 +0800 Subject: [PATCH] [CVE] CVE-2025-11561 to #26088 add patch to fix CVE-2025-11561 Project: TC2024080204 Signed-off-by: tomcruiseqi --- 1-bugfix-for-CVE-2025-11561.patch | 48 +++++++++++++++++++++++++++++++ sssd.spec | 6 +++- 2 files changed, 53 insertions(+), 1 deletion(-) create mode 100644 1-bugfix-for-CVE-2025-11561.patch diff --git a/1-bugfix-for-CVE-2025-11561.patch b/1-bugfix-for-CVE-2025-11561.patch new file mode 100644 index 0000000..941237a --- /dev/null +++ b/1-bugfix-for-CVE-2025-11561.patch @@ -0,0 +1,48 @@ +From 9939c39d1949fad48af2f0b43c788bad0809e310 Mon Sep 17 00:00:00 2001 +From: Sumit Bose +Date: Fri, 10 Oct 2025 12:57:40 +0200 +Subject: [PATCH] krb5: disable Kerberos localauth an2ln plugin for AD/IPA +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +If a client is joined to AD or IPA SSSD's localauth plugin can handle +the mapping of Kerberos principals to local accounts. In case it cannot +map the Kerberos principals libkrb5 is currently configured to fall back +to the default localauth plugins 'default', 'rule', 'names', +'auth_to_local', 'k5login' and 'an2ln' (see man krb5.conf for details). +All plugins except 'an2ln' require some explicit configuration by either +the administrator or the local user. To avoid some unexpected mapping is +done by the 'an2ln' plugin this patch disables it in the configuration +snippets for SSSD's localauth plugin. + +Resolves: https://github.com/SSSD/sssd/issues/8021 + +:relnote: After startup SSSD already creates a Kerberos configuration + snippet typically in /var/lib/sss/pubconf/krb5.include.d/localauth_plugin + if the AD or IPA providers are used. This enables SSSD's localauth plugin. + Starting with this release the an2ln plugin is disabled in the + configuration snippet as well. If this file or its content are included in + the Kerberos configuration it will fix CVE-2025-11561. + +Reviewed-by: Alexey Tikhonov +Reviewed-by: Pavel Březina +--- + src/util/domain_info_utils.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/src/util/domain_info_utils.c b/src/util/domain_info_utils.c +index 487145e3d..e76189ef1 100644 +--- a/src/util/domain_info_utils.c ++++ b/src/util/domain_info_utils.c +@@ -722,6 +722,7 @@ done: + #define LOCALAUTH_PLUGIN_CONFIG \ + "[plugins]\n" \ + " localauth = {\n" \ ++" disable = an2ln\n" \ + " module = sssd:"APP_MODULES_PATH"/sssd_krb5_localauth_plugin.so\n" \ + " }\n" + +-- +2.48.1 + diff --git a/sssd.spec b/sssd.spec index 118bc97..eaf211b 100644 --- a/sssd.spec +++ b/sssd.spec @@ -1,4 +1,4 @@ -%define anolis_release 2 +%define anolis_release 3 %global sssd_user sssd %global child_attrs 4750 @@ -25,6 +25,7 @@ URL: https://github.com/SSSD/sssd/ Source0: https://github.com/SSSD/sssd/releases/download/%{version}/sssd-%{version}.tar.gz Patch0: sssd-fix-CVE-2023-3758.patch +Patch1: 1-bugfix-for-CVE-2025-11561.patch ### Dependencies ### @@ -1030,6 +1031,9 @@ fi %systemd_postun_with_restart sssd.service %changelog +* Sat Nov 01 2025 tomcruiseqi - 2.9.4-3 +- Fix CVE-2025-11561 + * Wed May 15 2024 dash - 2.9.4-2 - fix CVE-2023-3758 -- Gitee