CVE-2023-3758: Sssd: race condition during authorization leads to gpo policies functioning inconsistently
Description
A race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated users. This may lead to improper authorization issues, granting or denying access to resources inappropriately.
Classification
CVE ID: CVE-2023-3758
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.04% (probability of being exploited)
EPSS Percentile: 15.23% (scored less or equal to compared to others)
EPSS Date: 2025-02-03 (when was this score calculated)
References
https://access.redhat.com/errata/RHSA-2024:1919https://access.redhat.com/errata/RHSA-2024:1920
https://access.redhat.com/errata/RHSA-2024:1921
https://access.redhat.com/errata/RHSA-2024:1922
https://access.redhat.com/errata/RHSA-2024:2571
https://access.redhat.com/errata/RHSA-2024:3270
https://access.redhat.com/security/cve/CVE-2023-3758
https://bugzilla.redhat.com/show_bug.cgi?id=2223762
https://github.com/SSSD/sssd/pull/7302