Skip to content

certmap: check that SID exists in certificate - #9408

Merged
alexey-tikhonov merged 1 commit into
SSSD:masterfrom
thalman:pam_gss_api_flow
Oct 9, 2026
Merged

alexey-tikhonov merged 1 commit into
SSSD:masterfrom
thalman:pam_gss_api_flow

Conversation

@thalman

@thalman thalman commented Oct 8, 2026

Copy link
Copy Markdown
Contributor

We have to check that SID is not NULL before using it in mapping rule.

:fixes: CVE-2026-104038

@sumit-bose sumit-bose left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi,

thank you for the fix and for adding a test, ACK.

CI failures are not related.

bye,
Sumit

We have to check that SID is not NULL before using
it in mapping rule.

:fixes: CVE-2026-104038

Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
Reviewed-by: Sumit Bose <sbose@redhat.com>
@sssd-bot

sssd-bot commented Oct 9, 2026

Copy link
Copy Markdown
Contributor

The pull request was accepted by @sumit-bose with the following PR CI status:


🟢 CodeQL (success)
🟢 osh-diff-scan:fedora-rawhide-x86_64:upstream (success)
🟢 rpm-build:centos-stream-10-x86_64:upstream (success)
🟢 rpm-build:fedora-43-x86_64:upstream (success)
🟢 rpm-build:fedora-44-x86_64:upstream (success)
🟢 rpm-build:fedora-45-x86_64:upstream (success)
🟢 rpm-build:fedora-rawhide-x86_64:upstream (success)
🔴 testing-farm:centos-stream-10-x86_64:upstream (failure)
🟢 testing-farm:fedora-43-x86_64:upstream (success)
🟢 testing-farm:fedora-44-x86_64:upstream (success)
🟢 testing-farm:fedora-45-x86_64:upstream (success)
🔴 testing-farm:fedora-rawhide-x86_64:upstream (failure)
🔴 Build / freebsd (failure)
🟢 Build / make-distcheck (success)
🟢 ci / intgcheck (centos-10) (success)
🟢 ci / intgcheck (fedora-43) (success)
🟢 ci / intgcheck (fedora-44) (success)
🟢 ci / intgcheck (fedora-45) (success)
🟢 ci / intgcheck (fedora-46) (success)
🟢 ci / prepare (success)
🟢 ci / system (centos-10) (success)
🟢 ci / system (fedora-43) (success)
🟢 ci / system (fedora-44) (success)
🔴 ci / system (fedora-45) (failure)
🔴 ci / system (fedora-46) (failure)
➖ Coverity scan / coverity (skipped)
🟢 Static code analysis / codeql (success)
🟢 Static code analysis / files-changed (success)
🟢 Static code analysis / pre-commit (success)
➖ Static code analysis / python-system-tests (skipped)


There are unsuccessful or unfinished checks. Make sure that the failures are not related to this pull request before merging.

@alexey-tikhonov
alexey-tikhonov merged commit db521e9 into SSSD:master Oct 9, 2026
15 of 22 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants