High
Sssd: race condition during authorization leads to gpo policies functioning inconsistently
Type: advisorySources: OSV
A race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated users. This may lead to improper authorization issues, granting or denying access to resources inappropriately.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2023-3758
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 04:51 UTC · Revision 1
Source evidence
Sssd: race condition during authorization leads to gpo policies functioning inconsistently
core-osv · Original sourcePublished 18 Apr 2024, 19:06 UTC
A race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated users. This may lead to improper authorization issues, granting or denying access to resources inappropriately.
osv:CVE-2023-3758
Complete source record
{
"id": "279c45aa98e426b01af0702aa9b2076b5901abae4731c214f568e68ddc13c7d8",
"url": "https://osv.dev/vulnerability/CVE-2023-3758",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Sssd: race condition during authorization leads to gpo policies functioning inconsistently",
"summary": "A race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated users. This may lead to improper authorization issues, granting or denying access to resources inappropriately.",
"evidence": "osv:CVE-2023-3758",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2023-3758",
"aliases": [
"CVE-2023-3758"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/sssd/sssd",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "595c4c6d2bcee3f88818813585eccda80546e0ab"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "2.9.5"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"cpe": "cpe:2.3:a:fedoraproject:sssd:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "2.9.5"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"2.9.4",
"2.9.3",
"2.9.2",
"2.9.1",
"2.9.0",
"2.8.0",
"2.7.0",
"2.6.3",
"2.6.2",
"2.6.1",
"2.6.0",
"2.5.2",
"2.5.1",
"2.5.0",
"2.4.2",
"2.4.1",
"sssd-2_4_0",
"sssd-2_3_1",
"sssd-2_3_0",
"sssd-2_2_3",
"sssd-2_2_2",
"sssd-2_2_1",
"sssd-2_2_0",
"sssd-2_1_0",
"sssd-1_16_3",
"sssd-1_16_2",
"sssd-1_16_1",
"sssd-1_16_0",
"sssd-1_15_3",
"sssd-1_15_2",
"sssd-1_15_1",
"sssd-1_15_0",
"sssd-1_14_2",
"sssd-1_14_1",
"sssd-1_14_0",
"sssd-1_14_0_beta1",
"sssd-1_13_91",
"sssd-1_14_0_alpha1",
"sssd-1_13_90",
"sssd-1_13_1",
"sssd-1_13_0",
"sssd-1_13_0_alpha",
"sssd-1_12_90",
"sssd-1_12_3",
"sssd-1_12_2",
"sssd-1_12_1",
"sssd-1_12_0",
"sssd-1_12_0_beta2",
"sssd-1_11_91",
"sssd-1_12_0_beta1",
"sssd-1_11_90",
"sssd-1_11_0",
"sssd-1_11_0_beta2",
"sssd-1_10_92",
"sssd-1_11_0_beta1",
"sssd-1_10_90",
"sssd-1_10_0",
"sssd-1_9_94",
"sssd-1_9_93",
"sssd-1_10_beta2",
"sssd-1_9_92",
"sssd-1_10_beta1",
"sssd-1_9_91",
"sssd-1_10_alpha1",
"sssd-1_9_2",
"sssd-1_9_1",
"sssd-1_9_0",
"sssd-1_9_0_rc1",
"sssd-1_8_98",
"sssd-1_9_0_beta7",
"sssd-1_8_97",
"sssd-1_9_0_beta6",
"sssd-1_8_96",
"sssd-1_9_0_beta5",
"sssd-1_8_95",
"sssd-1_9_0_beta4",
"sssd-1_8_94",
"sssd-1_9_0_beta3",
"sssd-1_8_93",
"sssd-1_9_0_beta2",
"sssd-1_8_92",
"sssd-1_9_0_beta1",
"sssd-1_8_91",
"sssd-1_6_0",
"sssd-1_5_1",
"sssd-1_5_0",
"sssd-1_4_0",
"sssd-1_3_0",
"sssd-1_2_91",
"sssd-1_0_99",
"sssd-0_99_0",
"sssd-0_7_0",
"sssd-0_6_0",
"sssd-0_5_0",
"sssd-0_4_1",
"sssd-0_4_0",
"sssd-0_3_3",
"sssd-0_3_2",
"sssd-0_3_1",
"sssd-0_2_1",
"sssd-0_2_0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-3758.json"
}
}
],
"modified": "2026-10-28T02:30:33.584457175Z",
"provider": "osv",
"references": [
"https://access.redhat.com/downloads/content/package-browser/",
"https://lists.debian.org/debian-lts-announce/2025/02/msg00008.html",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RV3HIZI3SURBUQKSOOL3XE64OOBQ2HTK/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XEP62IDS7A55D5UHM6GH7QZ7SQFOAPVF/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XMORAO2BDDA5YX4ZLMXDZ7SM6KU47SY5/",
"https://sssd.io/",
"https://access.redhat.com/errata/RHSA-2024:1919",
"https://access.redhat.com/errata/RHSA-2024:1920",
"https://access.redhat.com/errata/RHSA-2024:1921",
"https://access.redhat.com/errata/RHSA-2024:1922",
"https://access.redhat.com/errata/RHSA-2024:2571",
"https://access.redhat.com/errata/RHSA-2024:3270",
"https://access.redhat.com/security/cve/CVE-2023-3758",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/3xxx/CVE-2023-3758.json",
"https://nvd.nist.gov/vuln/detail/CVE-2023-3758",
"https://bugzilla.redhat.com/show_bug.cgi?id=2223762",
"https://github.com/SSSD/sssd/pull/7302"
],
"provider_metadata": {
"cwe_ids": [
"CWE-362"
],
"cna_assigner": "redhat",
"unresolved_ranges": [
{
"extracted_events": [
{
"range": [
{
"fixed": "0:2.9.4-3.el8_10"
},
{
"fixed": "0:2.9.4-3.el8_10"
},
{
"fixed": "0:2.6.2-4.el8_6.3"
},
{
"fixed": "0:2.8.2-4.el8_8.2"
},
{
"fixed": "0:2.9.4-6.el9_4"
},
{
"fixed": "0:2.9.4-6.el9_4"
},
{
"fixed": "0:2.6.2-4.el9_0.3"
},
{
"fixed": "0:2.8.2-5.el9_2.4"
},
{
"fixed": "0:2.6.2-4.el8_6.3"
}
],
"source": "AFFECTED_FIELD",
"strategy": "InverseAffectedRanges"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/3xxx/CVE-2023-3758.json"
}
},
"related_cves": [
{
"value": "CVE-2023-3758",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 500393,
"published_at": "2024-04-18T19:06:44.216+00:00"
}