CVE-2021-3621

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cache-expire subcommands. This flaw allows an attacker to trick the root user into running a specially crafted sssctl command, such as via sudo, to gain root access. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77 CWE-78

Affected software

Vendor	Product	Versions
n/a	sssd	sssd 2.6.0

References

https://bugzilla.redhat.com/show_bug.cgi?id=1975142Issue Tracking, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/05/msg00028.htmlThird Party Advisory
https://sssd.io/release-notes/sssd-2.6.0.htmlRelease Notes, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1975142Issue Tracking, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/05/msg00028.htmlThird Party Advisory
https://lists.debian.org/debian-lts-announce/2025/02/msg00008.html
https://sssd.io/release-notes/sssd-2.6.0.htmlRelease Notes, Third Party Advisory

Timeline

Published: Dec 23, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-362126.1app/View/SharingGroups/view.ctp in MISP before 2.4.146 allows stored XSS in the sharing groups view.CVE-2021-362137.5HashiCorp Consul and Consul Enterprise 1.9.0 through 1.10.0 default deny policy with a single L7 application-aware intention deny action can CVE-2021-362146.1LINE client for iOS before 10.16.3 allows cross site script with specific header in WebView.CVE-2021-362155.3LINE client for iOS 10.21.3 and before allows address bar spoofing due to inappropriate address handling.CVE-2021-362167.8LINE for Windows 6.2.1.2289 and before allows arbitrary code execution via malicious DLL injection.CVE-2021-362187.5An issue was discovered in SKALE sgxwallet 1.58.3. sgx_disp_ippsAES_GCMEncrypt allows an out-of-bounds write, resulting in a segfault and co CVE-2021-362199.8An issue was discovered in SKALE sgxwallet 1.58.3. The provided input for ECALL 14 triggers a branch in trustedEcdsaSign that frees a non-in CVE-2021-36224.3A flaw was found in the hivex library. This flaw allows an attacker to input a specially crafted Windows Registry (hive) file, which would c CVE-2021-362215.9Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil ReverseProxy panic upon an ErrAbortHand CVE-2021-362227.5ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.4 and 1.19.x before 1.19.2 a CVE-2021-362249.8Western Digital My Cloud devices before OS5 have a nobody account with a blank password.CVE-2021-362258.8Western Digital My Cloud devices before OS5 allow REST API access by low-privileged accounts, as demonstrated by API commands for firmware u