DEBIAN-CVE-2026-6245

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-6245
Import Source
https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-6245.json
JSON Data
https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2026-6245
Upstream
  • CVE-2026-6245
Published
2026-04-16T09:00:19.976153Z
Modified
2026-04-16T09:00:19.976153Z
Summary
[none]
Details

A flaw was found in the System Security Services Daemon (SSSD). The pampasskeychildreaddata() function within the PAM passkey responder fails to properly handle raw bytes received from a pipe. Because the data is treated as a NUL-terminated C string without explicit termination, it results in an out-of-bounds read when processed by functions like snprintf(). A local attacker could potentially trigger this vulnerability by initiating a crafted passkey authentication request, causing the SSSD PAM responder to crash, resulting in a local Denial of Service (DoS).

References

Affected packages

Debian:11 / sssd

Package

Name
sssd
Purl
pkg:deb/debian/sssd?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.4.1-2
2.4.1-2+deb11u1
2.5.2-1
2.5.2-2
2.5.2-3
2.5.2-4
2.5.2-5
2.6.1-1
2.6.3-1
2.6.3-2
2.6.3-3
2.7.0-1
2.7.1-1
2.7.1-2
2.7.2-1
2.7.2-2
2.7.2-3
2.7.3-1
2.7.3-2
2.7.4-1
2.8.1-1
2.8.1-2
2.8.2-1
2.8.2-2
2.8.2-3
2.8.2-4
2.9.1-1
2.9.1-2
2.9.2-1
2.9.4-1
2.9.4-1.1~exp1
2.9.4-1.1
2.9.4-2
2.9.5-1
2.9.5-2
2.9.5-3
2.9.5-4
2.9.5-5
2.10.1-1
2.10.1-2
2.11.1-1
2.11.1-2
2.11.1-2.1
2.12.0-1
2.12.0-2
2.12.0-3~exp0
2.12.0-4

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-6245.json"

Debian:12 / sssd

Package

Name
sssd
Purl
pkg:deb/debian/sssd?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.8.2-4
2.8.2-4+deb12u1
2.9.1-1
2.9.1-2
2.9.2-1
2.9.4-1
2.9.4-1.1~exp1
2.9.4-1.1
2.9.4-2
2.9.5-1
2.9.5-2
2.9.5-3
2.9.5-4
2.9.5-5
2.10.1-1
2.10.1-2
2.11.1-1
2.11.1-2
2.11.1-2.1
2.12.0-1
2.12.0-2
2.12.0-3~exp0
2.12.0-4

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-6245.json"

Debian:13 / sssd

Package

Name
sssd
Purl
pkg:deb/debian/sssd?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.10.1-2
2.11.1-1
2.11.1-2
2.11.1-2.1
2.12.0-1
2.12.0-2
2.12.0-3~exp0
2.12.0-4

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-6245.json"

Debian:14 / sssd

Package

Name
sssd
Purl
pkg:deb/debian/sssd?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.10.1-2
2.11.1-1
2.11.1-2
2.11.1-2.1
2.12.0-1
2.12.0-2
2.12.0-3~exp0
2.12.0-4

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-6245.json"