[Apollo] Advisories Statistics light light Login

RLSA-2025:21020

Security Mirrored from RHSA-2025:21020
Issued at: 2025-11-21
Updated at: 2025-11-23

Synopsis

Important: sssd security update



Description

The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to connect to multiple different account sources.

Security Fix(es):

* sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux systems (CVE-2025-11561)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.



Affected products

Rocky Linux 10 aarch64 Rocky Linux 10 ppc64le Rocky Linux 10 s390x Rocky Linux 10 x86_64

Fixes

2402727

CVEs

CVE-2025-11561

Affected packages

Rocky Linux 10 aarch64 - BaseOS

libipa_hbac-0:2.11.1-2.el10_1.1.aarch64.rpm libipa_hbac-debuginfo-0:2.11.1-2.el10_1.1.aarch64.rpm libsss_autofs-0:2.11.1-2.el10_1.1.aarch64.rpm libsss_autofs-debuginfo-0:2.11.1-2.el10_1.1.aarch64.rpm libsss_certmap-0:2.11.1-2.el10_1.1.aarch64.rpm libsss_certmap-debuginfo-0:2.11.1-2.el10_1.1.aarch64.rpm libsss_idmap-0:2.11.1-2.el10_1.1.aarch64.rpm libsss_idmap-debuginfo-0:2.11.1-2.el10_1.1.aarch64.rpm libsss_nss_idmap-0:2.11.1-2.el10_1.1.aarch64.rpm libsss_nss_idmap-debuginfo-0:2.11.1-2.el10_1.1.aarch64.rpm libsss_sudo-0:2.11.1-2.el10_1.1.aarch64.rpm libsss_sudo-debuginfo-0:2.11.1-2.el10_1.1.aarch64.rpm python3-libipa_hbac-0:2.11.1-2.el10_1.1.aarch64.rpm python3-libipa_hbac-debuginfo-0:2.11.1-2.el10_1.1.aarch64.rpm python3-libsss_nss_idmap-0:2.11.1-2.el10_1.1.aarch64.rpm python3-libsss_nss_idmap-debuginfo-0:2.11.1-2.el10_1.1.aarch64.rpm python3-sss-0:2.11.1-2.el10_1.1.aarch64.rpm python3-sssdconfig-0:2.11.1-2.el10_1.1.noarch.rpm python3-sss-debuginfo-0:2.11.1-2.el10_1.1.aarch64.rpm python3-sss-murmur-0:2.11.1-2.el10_1.1.aarch64.rpm python3-sss-murmur-debuginfo-0:2.11.1-2.el10_1.1.aarch64.rpm sssd-0:2.11.1-2.el10_1.1.aarch64.rpm sssd-0:2.11.1-2.el10_1.1.src.rpm sssd-ad-0:2.11.1-2.el10_1.1.aarch64.rpm sssd-ad-debuginfo-0:2.11.1-2.el10_1.1.aarch64.rpm sssd-client-0:2.11.1-2.el10_1.1.aarch64.rpm sssd-client-debuginfo-0:2.11.1-2.el10_1.1.aarch64.rpm sssd-common-0:2.11.1-2.el10_1.1.aarch64.rpm sssd-common-debuginfo-0:2.11.1-2.el10_1.1.aarch64.rpm sssd-common-pac-0:2.11.1-2.el10_1.1.aarch64.rpm sssd-common-pac-debuginfo-0:2.11.1-2.el10_1.1.aarch64.rpm sssd-dbus-0:2.11.1-2.el10_1.1.aarch64.rpm sssd-dbus-debuginfo-0:2.11.1-2.el10_1.1.aarch64.rpm sssd-debuginfo-0:2.11.1-2.el10_1.1.aarch64.rpm sssd-debugsource-0:2.11.1-2.el10_1.1.aarch64.rpm sssd-ipa-0:2.11.1-2.el10_1.1.aarch64.rpm sssd-ipa-debuginfo-0:2.11.1-2.el10_1.1.aarch64.rpm sssd-kcm-0:2.11.1-2.el10_1.1.aarch64.rpm sssd-kcm-debuginfo-0:2.11.1-2.el10_1.1.aarch64.rpm sssd-krb5-0:2.11.1-2.el10_1.1.aarch64.rpm sssd-krb5-common-0:2.11.1-2.el10_1.1.aarch64.rpm sssd-krb5-common-debuginfo-0:2.11.1-2.el10_1.1.aarch64.rpm sssd-krb5-debuginfo-0:2.11.1-2.el10_1.1.aarch64.rpm sssd-ldap-0:2.11.1-2.el10_1.1.aarch64.rpm sssd-ldap-debuginfo-0:2.11.1-2.el10_1.1.aarch64.rpm sssd-nfs-idmap-0:2.11.1-2.el10_1.1.aarch64.rpm sssd-nfs-idmap-debuginfo-0:2.11.1-2.el10_1.1.aarch64.rpm sssd-passkey-0:2.11.1-2.el10_1.1.aarch64.rpm sssd-passkey-debuginfo-0:2.11.1-2.el10_1.1.aarch64.rpm sssd-proxy-0:2.11.1-2.el10_1.1.aarch64.rpm sssd-proxy-debuginfo-0:2.11.1-2.el10_1.1.aarch64.rpm sssd-tools-0:2.11.1-2.el10_1.1.aarch64.rpm sssd-tools-debuginfo-0:2.11.1-2.el10_1.1.aarch64.rpm sssd-winbind-idmap-0:2.11.1-2.el10_1.1.aarch64.rpm sssd-winbind-idmap-debuginfo-0:2.11.1-2.el10_1.1.aarch64.rpm

Rocky Linux 10 ppc64le - BaseOS

libipa_hbac-0:2.11.1-2.el10_1.1.ppc64le.rpm libipa_hbac-debuginfo-0:2.11.1-2.el10_1.1.ppc64le.rpm libsss_autofs-0:2.11.1-2.el10_1.1.ppc64le.rpm libsss_autofs-debuginfo-0:2.11.1-2.el10_1.1.ppc64le.rpm libsss_certmap-0:2.11.1-2.el10_1.1.ppc64le.rpm libsss_certmap-debuginfo-0:2.11.1-2.el10_1.1.ppc64le.rpm libsss_idmap-0:2.11.1-2.el10_1.1.ppc64le.rpm libsss_idmap-debuginfo-0:2.11.1-2.el10_1.1.ppc64le.rpm libsss_nss_idmap-0:2.11.1-2.el10_1.1.ppc64le.rpm libsss_nss_idmap-debuginfo-0:2.11.1-2.el10_1.1.ppc64le.rpm libsss_sudo-0:2.11.1-2.el10_1.1.ppc64le.rpm libsss_sudo-debuginfo-0:2.11.1-2.el10_1.1.ppc64le.rpm python3-libipa_hbac-0:2.11.1-2.el10_1.1.ppc64le.rpm python3-libipa_hbac-debuginfo-0:2.11.1-2.el10_1.1.ppc64le.rpm python3-libsss_nss_idmap-0:2.11.1-2.el10_1.1.ppc64le.rpm python3-libsss_nss_idmap-debuginfo-0:2.11.1-2.el10_1.1.ppc64le.rpm python3-sss-0:2.11.1-2.el10_1.1.ppc64le.rpm python3-sssdconfig-0:2.11.1-2.el10_1.1.noarch.rpm python3-sss-debuginfo-0:2.11.1-2.el10_1.1.ppc64le.rpm python3-sss-murmur-0:2.11.1-2.el10_1.1.ppc64le.rpm python3-sss-murmur-debuginfo-0:2.11.1-2.el10_1.1.ppc64le.rpm sssd-0:2.11.1-2.el10_1.1.ppc64le.rpm sssd-0:2.11.1-2.el10_1.1.src.rpm sssd-ad-0:2.11.1-2.el10_1.1.ppc64le.rpm sssd-ad-debuginfo-0:2.11.1-2.el10_1.1.ppc64le.rpm sssd-client-0:2.11.1-2.el10_1.1.ppc64le.rpm sssd-client-debuginfo-0:2.11.1-2.el10_1.1.ppc64le.rpm sssd-common-0:2.11.1-2.el10_1.1.ppc64le.rpm sssd-common-debuginfo-0:2.11.1-2.el10_1.1.ppc64le.rpm sssd-common-pac-0:2.11.1-2.el10_1.1.ppc64le.rpm sssd-common-pac-debuginfo-0:2.11.1-2.el10_1.1.ppc64le.rpm sssd-dbus-0:2.11.1-2.el10_1.1.ppc64le.rpm sssd-dbus-debuginfo-0:2.11.1-2.el10_1.1.ppc64le.rpm sssd-debuginfo-0:2.11.1-2.el10_1.1.ppc64le.rpm sssd-debugsource-0:2.11.1-2.el10_1.1.ppc64le.rpm sssd-ipa-0:2.11.1-2.el10_1.1.ppc64le.rpm sssd-ipa-debuginfo-0:2.11.1-2.el10_1.1.ppc64le.rpm sssd-kcm-0:2.11.1-2.el10_1.1.ppc64le.rpm sssd-kcm-debuginfo-0:2.11.1-2.el10_1.1.ppc64le.rpm sssd-krb5-0:2.11.1-2.el10_1.1.ppc64le.rpm sssd-krb5-common-0:2.11.1-2.el10_1.1.ppc64le.rpm sssd-krb5-common-debuginfo-0:2.11.1-2.el10_1.1.ppc64le.rpm sssd-krb5-debuginfo-0:2.11.1-2.el10_1.1.ppc64le.rpm sssd-ldap-0:2.11.1-2.el10_1.1.ppc64le.rpm sssd-ldap-debuginfo-0:2.11.1-2.el10_1.1.ppc64le.rpm sssd-nfs-idmap-0:2.11.1-2.el10_1.1.ppc64le.rpm sssd-nfs-idmap-debuginfo-0:2.11.1-2.el10_1.1.ppc64le.rpm sssd-passkey-0:2.11.1-2.el10_1.1.ppc64le.rpm sssd-passkey-debuginfo-0:2.11.1-2.el10_1.1.ppc64le.rpm sssd-proxy-0:2.11.1-2.el10_1.1.ppc64le.rpm sssd-proxy-debuginfo-0:2.11.1-2.el10_1.1.ppc64le.rpm sssd-tools-0:2.11.1-2.el10_1.1.ppc64le.rpm sssd-tools-debuginfo-0:2.11.1-2.el10_1.1.ppc64le.rpm sssd-winbind-idmap-0:2.11.1-2.el10_1.1.ppc64le.rpm sssd-winbind-idmap-debuginfo-0:2.11.1-2.el10_1.1.ppc64le.rpm

Rocky Linux 10 s390x - BaseOS

libipa_hbac-0:2.11.1-2.el10_1.1.s390x.rpm libipa_hbac-debuginfo-0:2.11.1-2.el10_1.1.s390x.rpm libsss_autofs-0:2.11.1-2.el10_1.1.s390x.rpm libsss_autofs-debuginfo-0:2.11.1-2.el10_1.1.s390x.rpm libsss_certmap-0:2.11.1-2.el10_1.1.s390x.rpm libsss_certmap-debuginfo-0:2.11.1-2.el10_1.1.s390x.rpm libsss_idmap-0:2.11.1-2.el10_1.1.s390x.rpm libsss_idmap-debuginfo-0:2.11.1-2.el10_1.1.s390x.rpm libsss_nss_idmap-0:2.11.1-2.el10_1.1.s390x.rpm libsss_nss_idmap-debuginfo-0:2.11.1-2.el10_1.1.s390x.rpm libsss_sudo-0:2.11.1-2.el10_1.1.s390x.rpm libsss_sudo-debuginfo-0:2.11.1-2.el10_1.1.s390x.rpm python3-libipa_hbac-0:2.11.1-2.el10_1.1.s390x.rpm python3-libipa_hbac-debuginfo-0:2.11.1-2.el10_1.1.s390x.rpm python3-libsss_nss_idmap-0:2.11.1-2.el10_1.1.s390x.rpm python3-libsss_nss_idmap-debuginfo-0:2.11.1-2.el10_1.1.s390x.rpm python3-sss-0:2.11.1-2.el10_1.1.s390x.rpm python3-sssdconfig-0:2.11.1-2.el10_1.1.noarch.rpm python3-sss-debuginfo-0:2.11.1-2.el10_1.1.s390x.rpm python3-sss-murmur-0:2.11.1-2.el10_1.1.s390x.rpm python3-sss-murmur-debuginfo-0:2.11.1-2.el10_1.1.s390x.rpm sssd-0:2.11.1-2.el10_1.1.s390x.rpm sssd-0:2.11.1-2.el10_1.1.src.rpm sssd-ad-0:2.11.1-2.el10_1.1.s390x.rpm sssd-ad-debuginfo-0:2.11.1-2.el10_1.1.s390x.rpm sssd-client-0:2.11.1-2.el10_1.1.s390x.rpm sssd-client-debuginfo-0:2.11.1-2.el10_1.1.s390x.rpm sssd-common-0:2.11.1-2.el10_1.1.s390x.rpm sssd-common-debuginfo-0:2.11.1-2.el10_1.1.s390x.rpm sssd-common-pac-0:2.11.1-2.el10_1.1.s390x.rpm sssd-common-pac-debuginfo-0:2.11.1-2.el10_1.1.s390x.rpm sssd-dbus-0:2.11.1-2.el10_1.1.s390x.rpm sssd-dbus-debuginfo-0:2.11.1-2.el10_1.1.s390x.rpm sssd-debuginfo-0:2.11.1-2.el10_1.1.s390x.rpm sssd-debugsource-0:2.11.1-2.el10_1.1.s390x.rpm sssd-ipa-0:2.11.1-2.el10_1.1.s390x.rpm sssd-ipa-debuginfo-0:2.11.1-2.el10_1.1.s390x.rpm sssd-kcm-0:2.11.1-2.el10_1.1.s390x.rpm sssd-kcm-debuginfo-0:2.11.1-2.el10_1.1.s390x.rpm sssd-krb5-0:2.11.1-2.el10_1.1.s390x.rpm sssd-krb5-common-0:2.11.1-2.el10_1.1.s390x.rpm sssd-krb5-common-debuginfo-0:2.11.1-2.el10_1.1.s390x.rpm sssd-krb5-debuginfo-0:2.11.1-2.el10_1.1.s390x.rpm sssd-ldap-0:2.11.1-2.el10_1.1.s390x.rpm sssd-ldap-debuginfo-0:2.11.1-2.el10_1.1.s390x.rpm sssd-nfs-idmap-0:2.11.1-2.el10_1.1.s390x.rpm sssd-nfs-idmap-debuginfo-0:2.11.1-2.el10_1.1.s390x.rpm sssd-passkey-0:2.11.1-2.el10_1.1.s390x.rpm sssd-passkey-debuginfo-0:2.11.1-2.el10_1.1.s390x.rpm sssd-proxy-0:2.11.1-2.el10_1.1.s390x.rpm sssd-proxy-debuginfo-0:2.11.1-2.el10_1.1.s390x.rpm sssd-tools-0:2.11.1-2.el10_1.1.s390x.rpm sssd-tools-debuginfo-0:2.11.1-2.el10_1.1.s390x.rpm sssd-winbind-idmap-0:2.11.1-2.el10_1.1.s390x.rpm sssd-winbind-idmap-debuginfo-0:2.11.1-2.el10_1.1.s390x.rpm

Rocky Linux 10 x86_64 - BaseOS

libipa_hbac-0:2.11.1-2.el10_1.1.x86_64.rpm libipa_hbac-debuginfo-0:2.11.1-2.el10_1.1.x86_64.rpm libsss_autofs-0:2.11.1-2.el10_1.1.x86_64.rpm libsss_autofs-debuginfo-0:2.11.1-2.el10_1.1.x86_64.rpm libsss_certmap-0:2.11.1-2.el10_1.1.x86_64.rpm libsss_certmap-debuginfo-0:2.11.1-2.el10_1.1.x86_64.rpm libsss_idmap-0:2.11.1-2.el10_1.1.x86_64.rpm libsss_idmap-debuginfo-0:2.11.1-2.el10_1.1.x86_64.rpm libsss_nss_idmap-0:2.11.1-2.el10_1.1.x86_64.rpm libsss_nss_idmap-debuginfo-0:2.11.1-2.el10_1.1.x86_64.rpm libsss_sudo-0:2.11.1-2.el10_1.1.x86_64.rpm libsss_sudo-debuginfo-0:2.11.1-2.el10_1.1.x86_64.rpm python3-libipa_hbac-0:2.11.1-2.el10_1.1.x86_64.rpm python3-libipa_hbac-debuginfo-0:2.11.1-2.el10_1.1.x86_64.rpm python3-libsss_nss_idmap-0:2.11.1-2.el10_1.1.x86_64.rpm python3-libsss_nss_idmap-debuginfo-0:2.11.1-2.el10_1.1.x86_64.rpm python3-sss-0:2.11.1-2.el10_1.1.x86_64.rpm python3-sssdconfig-0:2.11.1-2.el10_1.1.noarch.rpm python3-sss-debuginfo-0:2.11.1-2.el10_1.1.x86_64.rpm python3-sss-murmur-0:2.11.1-2.el10_1.1.x86_64.rpm python3-sss-murmur-debuginfo-0:2.11.1-2.el10_1.1.x86_64.rpm sssd-0:2.11.1-2.el10_1.1.src.rpm sssd-0:2.11.1-2.el10_1.1.x86_64.rpm sssd-ad-0:2.11.1-2.el10_1.1.x86_64.rpm sssd-ad-debuginfo-0:2.11.1-2.el10_1.1.x86_64.rpm sssd-client-0:2.11.1-2.el10_1.1.x86_64.rpm sssd-client-debuginfo-0:2.11.1-2.el10_1.1.x86_64.rpm sssd-common-0:2.11.1-2.el10_1.1.x86_64.rpm sssd-common-debuginfo-0:2.11.1-2.el10_1.1.x86_64.rpm sssd-common-pac-0:2.11.1-2.el10_1.1.x86_64.rpm sssd-common-pac-debuginfo-0:2.11.1-2.el10_1.1.x86_64.rpm sssd-dbus-0:2.11.1-2.el10_1.1.x86_64.rpm sssd-dbus-debuginfo-0:2.11.1-2.el10_1.1.x86_64.rpm sssd-debuginfo-0:2.11.1-2.el10_1.1.x86_64.rpm sssd-debugsource-0:2.11.1-2.el10_1.1.x86_64.rpm sssd-ipa-0:2.11.1-2.el10_1.1.x86_64.rpm sssd-ipa-debuginfo-0:2.11.1-2.el10_1.1.x86_64.rpm sssd-kcm-0:2.11.1-2.el10_1.1.x86_64.rpm sssd-kcm-debuginfo-0:2.11.1-2.el10_1.1.x86_64.rpm sssd-krb5-0:2.11.1-2.el10_1.1.x86_64.rpm sssd-krb5-common-0:2.11.1-2.el10_1.1.x86_64.rpm sssd-krb5-common-debuginfo-0:2.11.1-2.el10_1.1.x86_64.rpm sssd-krb5-debuginfo-0:2.11.1-2.el10_1.1.x86_64.rpm sssd-ldap-0:2.11.1-2.el10_1.1.x86_64.rpm sssd-ldap-debuginfo-0:2.11.1-2.el10_1.1.x86_64.rpm sssd-nfs-idmap-0:2.11.1-2.el10_1.1.x86_64.rpm sssd-nfs-idmap-debuginfo-0:2.11.1-2.el10_1.1.x86_64.rpm sssd-passkey-0:2.11.1-2.el10_1.1.x86_64.rpm sssd-passkey-debuginfo-0:2.11.1-2.el10_1.1.x86_64.rpm sssd-proxy-0:2.11.1-2.el10_1.1.x86_64.rpm sssd-proxy-debuginfo-0:2.11.1-2.el10_1.1.x86_64.rpm sssd-tools-0:2.11.1-2.el10_1.1.x86_64.rpm sssd-tools-debuginfo-0:2.11.1-2.el10_1.1.x86_64.rpm sssd-winbind-idmap-0:2.11.1-2.el10_1.1.x86_64.rpm sssd-winbind-idmap-debuginfo-0:2.11.1-2.el10_1.1.x86_64.rpm

Rocky Linux 10 aarch64 - CRB

libsss_nss_idmap-devel-0:2.11.1-2.el10_1.1.aarch64.rpm

Rocky Linux 10 ppc64le - CRB

libsss_nss_idmap-devel-0:2.11.1-2.el10_1.1.ppc64le.rpm

Rocky Linux 10 s390x - CRB

libsss_nss_idmap-devel-0:2.11.1-2.el10_1.1.s390x.rpm

Rocky Linux 10 x86_64 - CRB

libsss_nss_idmap-devel-0:2.11.1-2.el10_1.1.x86_64.rpm

Rocky Linux 10 aarch64 - AppStream

sssd-idp-0:2.11.1-2.el10_1.1.aarch64.rpm sssd-idp-debuginfo-0:2.11.1-2.el10_1.1.aarch64.rpm

Rocky Linux 10 ppc64le - AppStream

sssd-idp-0:2.11.1-2.el10_1.1.ppc64le.rpm sssd-idp-debuginfo-0:2.11.1-2.el10_1.1.ppc64le.rpm

Rocky Linux 10 s390x - AppStream

sssd-idp-0:2.11.1-2.el10_1.1.s390x.rpm sssd-idp-debuginfo-0:2.11.1-2.el10_1.1.s390x.rpm

Rocky Linux 10 x86_64 - AppStream

sssd-idp-0:2.11.1-2.el10_1.1.x86_64.rpm sssd-idp-debuginfo-0:2.11.1-2.el10_1.1.x86_64.rpm