ALAS2-2026-3828

Amazon Linux 2 Security Advisory: ALAS2-2026-3828
Advisory Released Date: 2026-08-04
Advisory Updated Date: 2026-08-04
Severity: Important
Issue Overview:

A flaw was found in sssd. When authenticating with a YubiKey, the SSSD PAM responder can crash due to a use-after-free vulnerability, where a memory pointer is incorrectly handled. A local attacker could exploit this flaw by manipulating smartcard or YubiKey contents, leading to a denial of service that disrupts authentication. This vulnerability also presents a potential for privilege escalation, although it is difficult to exploit. (CVE-2026-12610)

A flaw was found in SSSD's LDAP sudo provider. When the ldap_sudo_search_base option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo privileges on all SSSD-enrolled hosts. (CVE-2026-14474)

A path traversal flaw was found in SSSD's AD GPO provider. The ad_gpo_extract_smb_components() function does not sanitize .. sequences in the gPCFileSysPath LDAP attribute, allowing an attacker with AD GPO management access to write files outside the GPO cache directory as root. On default RHEL configurations with SELinux enforcing, this can be used to inject Kerberos configuration leading to authentication bypass. (CVE-2026-14476)


Affected Packages:

sssd


Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.


Issue Correction:
Run yum update sssd or yum update --advisory ALAS2-2026-3828 to update your system.

New Packages:
aarch64:
    sssd-1.16.5-12.amzn2.15.aarch64
    sssd-common-1.16.5-12.amzn2.15.aarch64
    sssd-client-1.16.5-12.amzn2.15.aarch64
    libsss_sudo-1.16.5-12.amzn2.15.aarch64
    libsss_autofs-1.16.5-12.amzn2.15.aarch64
    sssd-tools-1.16.5-12.amzn2.15.aarch64
    python-sss-1.16.5-12.amzn2.15.aarch64
    python-sss-murmur-1.16.5-12.amzn2.15.aarch64
    sssd-ldap-1.16.5-12.amzn2.15.aarch64
    sssd-krb5-common-1.16.5-12.amzn2.15.aarch64
    sssd-krb5-1.16.5-12.amzn2.15.aarch64
    sssd-common-pac-1.16.5-12.amzn2.15.aarch64
    sssd-ipa-1.16.5-12.amzn2.15.aarch64
    sssd-ad-1.16.5-12.amzn2.15.aarch64
    sssd-proxy-1.16.5-12.amzn2.15.aarch64
    libsss_idmap-1.16.5-12.amzn2.15.aarch64
    libsss_idmap-devel-1.16.5-12.amzn2.15.aarch64
    libipa_hbac-1.16.5-12.amzn2.15.aarch64
    libipa_hbac-devel-1.16.5-12.amzn2.15.aarch64
    python-libipa_hbac-1.16.5-12.amzn2.15.aarch64
    libsss_nss_idmap-1.16.5-12.amzn2.15.aarch64
    libsss_nss_idmap-devel-1.16.5-12.amzn2.15.aarch64
    python-libsss_nss_idmap-1.16.5-12.amzn2.15.aarch64
    sssd-dbus-1.16.5-12.amzn2.15.aarch64
    sssd-polkit-rules-1.16.5-12.amzn2.15.aarch64
    libsss_simpleifp-1.16.5-12.amzn2.15.aarch64
    libsss_simpleifp-devel-1.16.5-12.amzn2.15.aarch64
    sssd-libwbclient-1.16.5-12.amzn2.15.aarch64
    sssd-libwbclient-devel-1.16.5-12.amzn2.15.aarch64
    sssd-winbind-idmap-1.16.5-12.amzn2.15.aarch64
    libsss_certmap-1.16.5-12.amzn2.15.aarch64
    libsss_certmap-devel-1.16.5-12.amzn2.15.aarch64
    sssd-kcm-1.16.5-12.amzn2.15.aarch64
    sssd-debuginfo-1.16.5-12.amzn2.15.aarch64

i686:
    sssd-1.16.5-12.amzn2.15.i686
    sssd-common-1.16.5-12.amzn2.15.i686
    sssd-client-1.16.5-12.amzn2.15.i686
    libsss_sudo-1.16.5-12.amzn2.15.i686
    libsss_autofs-1.16.5-12.amzn2.15.i686
    sssd-tools-1.16.5-12.amzn2.15.i686
    python-sss-1.16.5-12.amzn2.15.i686
    python-sss-murmur-1.16.5-12.amzn2.15.i686
    sssd-ldap-1.16.5-12.amzn2.15.i686
    sssd-krb5-common-1.16.5-12.amzn2.15.i686
    sssd-krb5-1.16.5-12.amzn2.15.i686
    sssd-common-pac-1.16.5-12.amzn2.15.i686
    sssd-ipa-1.16.5-12.amzn2.15.i686
    sssd-ad-1.16.5-12.amzn2.15.i686
    sssd-proxy-1.16.5-12.amzn2.15.i686
    libsss_idmap-1.16.5-12.amzn2.15.i686
    libsss_idmap-devel-1.16.5-12.amzn2.15.i686
    libipa_hbac-1.16.5-12.amzn2.15.i686
    libipa_hbac-devel-1.16.5-12.amzn2.15.i686
    python-libipa_hbac-1.16.5-12.amzn2.15.i686
    libsss_nss_idmap-1.16.5-12.amzn2.15.i686
    libsss_nss_idmap-devel-1.16.5-12.amzn2.15.i686
    python-libsss_nss_idmap-1.16.5-12.amzn2.15.i686
    sssd-dbus-1.16.5-12.amzn2.15.i686
    sssd-polkit-rules-1.16.5-12.amzn2.15.i686
    libsss_simpleifp-1.16.5-12.amzn2.15.i686
    libsss_simpleifp-devel-1.16.5-12.amzn2.15.i686
    sssd-libwbclient-1.16.5-12.amzn2.15.i686
    sssd-libwbclient-devel-1.16.5-12.amzn2.15.i686
    sssd-winbind-idmap-1.16.5-12.amzn2.15.i686
    libsss_certmap-1.16.5-12.amzn2.15.i686
    libsss_certmap-devel-1.16.5-12.amzn2.15.i686
    sssd-kcm-1.16.5-12.amzn2.15.i686
    sssd-debuginfo-1.16.5-12.amzn2.15.i686

noarch:
    python-sssdconfig-1.16.5-12.amzn2.15.noarch

src:
    sssd-1.16.5-12.amzn2.15.src

x86_64:
    sssd-1.16.5-12.amzn2.15.x86_64
    sssd-common-1.16.5-12.amzn2.15.x86_64
    sssd-client-1.16.5-12.amzn2.15.x86_64
    libsss_sudo-1.16.5-12.amzn2.15.x86_64
    libsss_autofs-1.16.5-12.amzn2.15.x86_64
    sssd-tools-1.16.5-12.amzn2.15.x86_64
    python-sss-1.16.5-12.amzn2.15.x86_64
    python-sss-murmur-1.16.5-12.amzn2.15.x86_64
    sssd-ldap-1.16.5-12.amzn2.15.x86_64
    sssd-krb5-common-1.16.5-12.amzn2.15.x86_64
    sssd-krb5-1.16.5-12.amzn2.15.x86_64
    sssd-common-pac-1.16.5-12.amzn2.15.x86_64
    sssd-ipa-1.16.5-12.amzn2.15.x86_64
    sssd-ad-1.16.5-12.amzn2.15.x86_64
    sssd-proxy-1.16.5-12.amzn2.15.x86_64
    libsss_idmap-1.16.5-12.amzn2.15.x86_64
    libsss_idmap-devel-1.16.5-12.amzn2.15.x86_64
    libipa_hbac-1.16.5-12.amzn2.15.x86_64
    libipa_hbac-devel-1.16.5-12.amzn2.15.x86_64
    python-libipa_hbac-1.16.5-12.amzn2.15.x86_64
    libsss_nss_idmap-1.16.5-12.amzn2.15.x86_64
    libsss_nss_idmap-devel-1.16.5-12.amzn2.15.x86_64
    python-libsss_nss_idmap-1.16.5-12.amzn2.15.x86_64
    sssd-dbus-1.16.5-12.amzn2.15.x86_64
    sssd-polkit-rules-1.16.5-12.amzn2.15.x86_64
    libsss_simpleifp-1.16.5-12.amzn2.15.x86_64
    libsss_simpleifp-devel-1.16.5-12.amzn2.15.x86_64
    sssd-libwbclient-1.16.5-12.amzn2.15.x86_64
    sssd-libwbclient-devel-1.16.5-12.amzn2.15.x86_64
    sssd-winbind-idmap-1.16.5-12.amzn2.15.x86_64
    libsss_certmap-1.16.5-12.amzn2.15.x86_64
    libsss_certmap-devel-1.16.5-12.amzn2.15.x86_64
    sssd-kcm-1.16.5-12.amzn2.15.x86_64
    sssd-debuginfo-1.16.5-12.amzn2.15.x86_64

Additional References

Release Notes:  Amazon Linux 2 Release Notes

Red Hat: CVE-2026-12610, CVE-2026-14474, CVE-2026-14476

Mitre: CVE-2026-12610, CVE-2026-14474, CVE-2026-14476