Skip to content
Fencer Vulns
high 8.8

CVE-2021-3621 json

A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cache-expire subcommand…

published 2021-12-23 4 y ago modified 2026-06-17 4 mo ago also EUVD-2021-26924

cvss
8.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.6%
EPSS 2.6% chance of exploitation in 30 days, percentile 85%
public exploits
0
none known

Summary

A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cache-expire subcommands. This flaw allows an attacker to trick the root user into running a specially crafted sssctl command, such as via sudo, to gain root access. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Patch / fix

  • sssd Debian 14, Debian 13, Debian 12 2.5.2-1

debian advisories DEBIAN-CVE-2021-3621

  • sssd Ubuntu 18.04 LTS 1.16.1-1ubuntu1.8
  • sssd Ubuntu 20.04 LTS 2.2.3-3ubuntu0.7
  • sssd Ubuntu 22.04 LTS 2.4.1-2ubuntu4

ubuntu advisories UBUNTU-CVE-2021-3621

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • redhat-virtualization-host rhev hypervisor 4.4 4.4.7-20210804.0.el8_4
  • redhat-virtualization-host-image-update rhev hypervisor 4.4 4.4.7-20210804.0.el8_4
  • redhat-virtualization-host RHEL 7 4.3.18-20210903.0.el7_9
  • redhat-virtualization-host-image-update RHEL 7 4.3.18-20210903.0.el7_9
  • sssd RHEL 7 1.16.5-10.el7_9.10
  • sssd-ad RHEL 7 1.16.5-10.el7_9.10
  • sssd-ipa RHEL 7 1.16.5-10.el7_9.10
  • sssd-kcm RHEL 7 1.16.5-10.el7_9.10

red hat advisories RHSA-2021:3235RHSA-2021:3477RHSA-2021:3336RHSA-2021:3365RHSA-2021:3178RHSA-2021:3151

  • sssd SLE Module for Basesystem 15 SP4, openSUSE Leap 15.4 2.5.2-150400.4.5.14
  • sssd SLES for SAP 12 SP4, SLES 12 SP4-LTSS, OpenStack Cloud Crowbar 9 +1 more 1.16.1-4.40.1
  • sssd SLES for SAP 15 SP1, SLES for SAP 15, SLES 15-LTSS +7 more 1.16.1-8.64.1
  • sssd SLE Module for Basesystem 15 SP2 1.16.1-17.14.1
  • sssd SLE Module for Basesystem 15 SP3 1.16.1-23.11.1
  • sssd SLES for SAP 12 SP5, SLES 12 SP5, SLE Software Development Kit 12 SP5 1.16.1-7.22.4

suse advisories SUSE-SU-2022:2763-1SUSE-SU-2022:1258-1SUSE-SU-2022:0826-1SUSE-RU-2021:3185-1SUSE-SU-2021:2941-1SUSE-SU-2021:2873-1

  • sssd openSUSE Tumbleweed 2.9.3-2.1
  • sssd openSUSE Leap 15.3 1.16.1-23.11.1

opensuse advisories openSUSE-SU-2024:13446-1openSUSE-SU-2021:2941-1

  • sssd Rocky Linux 8 2.4.0-9.el8_4.2

rocky linux advisories RLSA-2021:3151

  • sssd Arch Linux 2.6.0-1

arch linux advisories AVG-2314

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-3621 updated cvss 6.7

sssd: shell command injection in sssctl

  • Red Hat Enterprise Linux 6 sssd, sssd-ad, sssd-ipa, sssd-dbus, sssd-krb5, sssd-ldap, +19 more
    affected: workaround, no fix planned “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.”
  • Red Hat CodeReady Linux Builder (v. 8) sssd-debuginfo 2.4.0-9.el8_4.2, sssd-debugsource 2.4.0-9.el8_4.2, sssd-ad-debuginfo 2.4.0-9.el8_4.2, sssd-ipa-debuginfo 2.4.0-9.el8_4.2, sssd-kcm-debuginfo 2.4.0-9.el8_4.2, sssd-dbus-debuginfo 2.4.0-9.el8_4.2, +23 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2021:3151
  • Red Hat CodeReady Linux Builder EUS (v. 8.1) sssd-debuginfo 2.2.0-19.el8_1.2, sssd-debugsource 2.2.0-19.el8_1.2, sssd-ad-debuginfo 2.2.0-19.el8_1.2, sssd-ipa-debuginfo 2.2.0-19.el8_1.2, sssd-kcm-debuginfo 2.2.0-19.el8_1.2, sssd-dbus-debuginfo 2.2.0-19.el8_1.2, +23 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2021:3178
  • Red Hat CodeReady Linux Builder EUS (v. 8.2) sssd-debuginfo 2.2.3-20.el8_2.1, sssd-debugsource 2.2.3-20.el8_2.1, sssd-ad-debuginfo 2.2.3-20.el8_2.1, sssd-ipa-debuginfo 2.2.3-20.el8_2.1, sssd-kcm-debuginfo 2.2.3-20.el8_2.1, sssd-dbus-debuginfo 2.2.3-20.el8_2.1, +23 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2021:3365
  • Red Hat Enterprise Linux BaseOS (v. 8) sssd 2.4.0-9.el8_4.2, sssd-ad 2.4.0-9.el8_4.2, sssd-ipa 2.4.0-9.el8_4.2, sssd-kcm 2.4.0-9.el8_4.2, sssd-dbus 2.4.0-9.el8_4.2, sssd-krb5 2.4.0-9.el8_4.2, +23 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2021:3151
  • Red Hat Enterprise Linux BaseOS EUS (v. 8.1) sssd 2.2.0-19.el8_1.2, sssd-ad 2.2.0-19.el8_1.2, sssd-ipa 2.2.0-19.el8_1.2, sssd-kcm 2.2.0-19.el8_1.2, sssd-dbus 2.2.0-19.el8_1.2, sssd-krb5 2.2.0-19.el8_1.2, +23 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2021:3178
  • Red Hat Enterprise Linux BaseOS EUS (v. 8.2) sssd 2.2.3-20.el8_2.1, sssd-ad 2.2.3-20.el8_2.1, sssd-ipa 2.2.3-20.el8_2.1, sssd-kcm 2.2.3-20.el8_2.1, sssd-dbus 2.2.3-20.el8_2.1, sssd-krb5 2.2.3-20.el8_2.1, +23 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2021:3365
  • Red Hat Enterprise Linux Client (v. 7) sssd 1.16.5-10.el7_9.10, sssd-ad 1.16.5-10.el7_9.10, sssd-ipa 1.16.5-10.el7_9.10, sssd-kcm 1.16.5-10.el7_9.10, sssd-dbus 1.16.5-10.el7_9.10, sssd-krb5 1.16.5-10.el7_9.10, +21 more Red Hat Enterprise Linux Client Optional (v. 7) python-libsss_nss_idmap 1.16.5-10.el7_9.10 Red Hat Enterprise Linux ComputeNode Optional (v. 7) python-libsss_nss_idmap 1.16.5-10.el7_9.10 Red Hat Enterprise Linux Server (v. 7) sssd 1.16.5-10.el7_9.10, sssd-ad 1.16.5-10.el7_9.10, sssd-ipa 1.16.5-10.el7_9.10, sssd-kcm 1.16.5-10.el7_9.10, sssd-dbus 1.16.5-10.el7_9.10, sssd-krb5 1.16.5-10.el7_9.10, +22 more Red Hat Enterprise Linux Server Optional (v. 7) python-libsss_nss_idmap 1.16.5-10.el7_9.10 Red Hat Enterprise Linux Workstation (v. 7) sssd 1.16.5-10.el7_9.10, sssd-ad 1.16.5-10.el7_9.10, sssd-ipa 1.16.5-10.el7_9.10, sssd-kcm 1.16.5-10.el7_9.10, sssd-dbus 1.16.5-10.el7_9.10, sssd-krb5 1.16.5-10.el7_9.10, +22 more
    +1 more products
    Red Hat Enterprise Linux Workstation Optional (v. 7) sssd-debuginfo 1.16.5-10.el7_9.10, libipa_hbac-devel 1.16.5-10.el7_9.10, libsss_idmap-devel 1.16.5-10.el7_9.10, libsss_certmap-devel 1.16.5-10.el7_9.10, libsss_nss_idmap-devel 1.16.5-10.el7_9.10, libsss_simpleifp-devel 1.16.5-10.el7_9.10, +1 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2021:3336
show 4 more
  • Red Hat Virtualization 4 Hypervisor for RHEL 7 redhat-virtualization-host 4.3.18-20210903.0.el7_9, redhat-virtualization-host-image-update 4.3.18-20210903.0.el7_9
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2021:3477
  • Red Hat Virtualization 4 Hypervisor for RHEL 8 redhat-virtualization-host 4.4.7-20210804.0.el8_4, redhat-virtualization-host-image-update 4.4.7-20210804.0.el8_4
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2021:3235
  • Red Hat RHEL 7-based RHEV-H for RHEV 4 (build requirements) redhat-virtualization-host 4.3.18-20210903.0.el7_9, redhat-virtualization-host-image-update 4.3.18-20210903.0.el7_9
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2021:3477
  • Red Hat Enterprise Linux 9 sssd, sssd-ad, sssd-idp, sssd-ipa, sssd-kcm, sssd-dbus, +24 more Red Hat RHEL 7-based RHEV-H for RHEV 4 (build requirements) redhat-release-virtualization-host 4.3.18-1.el7ev, redhat-virtualization-host-image-update-placeholder 4.3.18-1.el7ev Red Hat RHEL 8-based RHEV-H for RHEV 4 (build requirements) imgbased 1.2.23-1.el8ev, python3-imgbased 1.2.23-1.el8ev, redhat-release-virtualization-host 4.4.7-4.el8ev, redhat-virtualization-host-image-update-placeholder 4.4.7-4.el8ev
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.65% chance of exploitation in the next 30 days, higher than 85% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD 2.0 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C

Affected products

  • n/a sssd

Classification

Weakness
  • CWE-77 Improper Neutralization of Special Elements used in a Command
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.