CVE-2017-7488

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Authconfig version 6.2.8 is vulnerable to an Information exposure while using SSSD to authenticate against remote server resulting in the leak of information about existing usernames.

Metrics

CVSS 3.0 4.3/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
authconfig	authconfig	6.2.8

References

http://www.securityfocus.com/bid/101784
https://access.redhat.com/errata/RHSA-2017:2285
https://bugzilla.redhat.com/show_bug.cgi?id=1441604Issue Tracking, Patch, Third Party Advisory, VDB Entry
https://pagure.io/authconfig/c/0972f61ad4b5657ed89cf953e8f58f6513096224?branch=masterPatch, Third Party Advisory
http://www.securityfocus.com/bid/101784
https://access.redhat.com/errata/RHSA-2017:2285
https://bugzilla.redhat.com/show_bug.cgi?id=1441604Issue Tracking, Patch, Third Party Advisory, VDB Entry
https://pagure.io/authconfig/c/0972f61ad4b5657ed89cf953e8f58f6513096224?branch=masterPatch, Third Party Advisory

Timeline

Published: May 16, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-74896.3In Moodle 2.x and 3.x, remote authenticated users can take ownership of arbitrary blogs by editing an external blog link.CVE-2017-74905.3In Moodle 2.x and 3.x, searching of arbitrary blogs is possible because a capability check is missing.CVE-2017-74914.3In Moodle 2.x and 3.x, a CSRF attack is possible that allows attackers to change the "number of courses displayed in the course overview blo CVE-2017-74937.8Quick Emulator (Qemu) built with the VirtFS, host directory sharing via Plan 9 File System(9pfs) support, is vulnerable to an improper acces CVE-2017-74949.8Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allowing a malicious cli CVE-2017-74955.5fs/ext4/inode.c in the Linux kernel before 4.6.2, when ext4 data=ordered mode is used, mishandles a needs-flushing-before-commit list, which CVE-2017-74967.0fedora-arm-installer up to and including 1.99.16 is vulnerable to local privilege escalation due to lack of checking the error condition of CVE-2017-74974.3The dialog for creating cloud volumes (cinder provider) in CloudForms does not filter cloud tenants by user. An attacker with the ability to CVE-2017-75007.8It was found that rpm did not properly handle RPM installations when a destination path was a symbolic link to a directory, possibly changin CVE-2017-75017.8It was found that versions of rpm before 4.13.0.2 use temporary files with predictable names when installing an RPM. An attacker with abilit CVE-2017-75027.5Null pointer dereference vulnerability in NSS since 3.24.0 was found when server receives empty SSLv2 messages resulting into denial of serv CVE-2017-75039.8It was found that the Red Hat JBoss EAP 7.0.5 implementation of javax.xml.transform.TransformerFactory is vulnerable to XXE. An attacker cou