Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package sssd for openSUSE:Factory checked in at 2026-09-19 22:19:53 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/sssd (Old) and /work/SRC/openSUSE:Factory/.sssd.new.383539 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "sssd" Sat Sep 19 22:19:53 2026 rev:154 rq:1378788 version:2.13.1 Changes: -------- --- /work/SRC/openSUSE:Factory/sssd/sssd.changes 2026-07-29 18:58:13.339520441 +0200 +++ /work/SRC/openSUSE:Factory/.sssd.new.383539/sssd.changes 2026-09-19 22:20:20.061581899 +0200 @@ -1,0 +2,7 @@ +Fri Sep 18 09:22:31 UTC 2026 - Samuel Cabrero <[email protected]> + +- Fix IDP provider cross-user impersonation; (bsc#1279915); + (CVE-2026-87853); Add patch + 0018-IDP-fix-user-matching-in-eval_access_token_buf.patch + +------------------------------------------------------------------- New: ---- 0018-IDP-fix-user-matching-in-eval_access_token_buf.patch ----------(New B)---------- New: (CVE-2026-87853); Add patch 0018-IDP-fix-user-matching-in-eval_access_token_buf.patch ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ sssd.spec ++++++ --- /var/tmp/diff_new_pack.xiKLnO/_old 2026-09-19 22:20:21.037622610 +0200 +++ /var/tmp/diff_new_pack.xiKLnO/_new 2026-09-19 22:20:21.039622694 +0200 @@ -38,6 +38,7 @@ Patch15: logrotate.patch Patch16: 0016-UsrEtc.patch Patch17: jwk.patch +Patch18: 0018-IDP-fix-user-matching-in-eval_access_token_buf.patch BuildRequires: autoconf >= 2.59 BuildRequires: automake BuildRequires: bc ++++++ 0018-IDP-fix-user-matching-in-eval_access_token_buf.patch ++++++ >From f3a324918c1a35bd0195a1de5b17897a0d3b6274 Mon Sep 17 00:00:00 2001 From: Alexey Tikhonov <[email protected]> Date: Wed, 9 Sep 2026 17:18:02 +0200 Subject: [PATCH] IDP: fix user matching in `eval_access_token_buf()` Make sure it is exact, not merely a prefix match. :fixes: CVE-2026-87853 Reviewed-by: Sumit Bose <[email protected]> --- src/providers/idp/idp_auth_eval.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/providers/idp/idp_auth_eval.c b/src/providers/idp/idp_auth_eval.c index e992c07ed..f6340b402 100644 --- a/src/providers/idp/idp_auth_eval.c +++ b/src/providers/idp/idp_auth_eval.c @@ -294,7 +294,8 @@ errno_t eval_access_token_buf(struct idp_auth_ctx *idp_auth_ctx, goto done; } - if (strncmp(uuid, (char *) user_reply, user_reply_len) != 0) { + if ((strlen(uuid) != user_reply_len) || + (strncmp(uuid, (char *) user_reply, user_reply_len) != 0)) { DEBUG(SSSDBG_OP_FAILURE, "UUID [%s] of user [%s] and input [%.*s] do not match.\n", uuid, user, (int) user_reply_len, user_reply); -- 2.55.0 ++++++ _scmsync.obsinfo ++++++ --- /var/tmp/diff_new_pack.xiKLnO/_old 2026-09-19 22:20:21.088624738 +0200 +++ /var/tmp/diff_new_pack.xiKLnO/_new 2026-09-19 22:20:21.091624863 +0200 @@ -1,5 +1,5 @@ -mtime: 1785036897 -commit: d001994c2d64eabf597353ca42018a437c9169e41e814dac081bc9646421cf70 +mtime: 1789723532 +commit: 1a74fdfabdb704342950a3bd6889c49fa3b59e0880c8f6b205ebb824824e06d6 url: https://src.opensuse.org/jengelh/sssd revision: master ++++++ build.specials.obscpio ++++++ ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-09-18 11:25:32.000000000 +0200 @@ -0,0 +1 @@ +.osc
