QSN-8718-1: SSSD vulnerability 2026-09-03 Summary: SSSD could be made to crash if it received specially crafted input. Details: It was discovered that SSSD did not properly validate authentication token lengths when processing PAM responder requests. A local attacker could possibly use this issue to cause SSSD to crash, resulting in a denial of service. Affected QuantaStor releases: 6.9.1.001 jammy: libipa-hbac0 2.6.3-1ubuntu3.9 (fixed in 2.6.3-1ubuntu3.9) 6.9.1.001 jammy: libnss-sss 2.6.3-1ubuntu3.9 (fixed in 2.6.3-1ubuntu3.9) 6.9.1.001 jammy: libpam-sss 2.6.3-1ubuntu3.9 (fixed in 2.6.3-1ubuntu3.9) 6.9.1.001 jammy: libsss-certmap0 2.6.3-1ubuntu3.9 (fixed in 2.6.3-1ubuntu3.9) 6.9.1.001 jammy: libsss-idmap0 2.6.3-1ubuntu3.9 (fixed in 2.6.3-1ubuntu3.9) 6.9.1.001 jammy: libsss-nss-idmap0 2.6.3-1ubuntu3.9 (fixed in 2.6.3-1ubuntu3.9) 6.9.1.001 jammy: python3-sss 2.6.3-1ubuntu3.9 (fixed in 2.6.3-1ubuntu3.9) 6.9.1.001 jammy: sssd 2.6.3-1ubuntu3.9 (fixed in 2.6.3-1ubuntu3.9) 6.9.1.001 jammy: sssd-ad 2.6.3-1ubuntu3.9 (fixed in 2.6.3-1ubuntu3.9) 6.9.1.001 jammy: sssd-ad-common 2.6.3-1ubuntu3.9 (fixed in 2.6.3-1ubuntu3.9) 6.9.1.001 jammy: sssd-common 2.6.3-1ubuntu3.9 (fixed in 2.6.3-1ubuntu3.9) 6.9.1.001 jammy: sssd-ipa 2.6.3-1ubuntu3.9 (fixed in 2.6.3-1ubuntu3.9) 6.9.1.001 jammy: sssd-krb5 2.6.3-1ubuntu3.9 (fixed in 2.6.3-1ubuntu3.9) 6.9.1.001 jammy: sssd-krb5-common 2.6.3-1ubuntu3.9 (fixed in 2.6.3-1ubuntu3.9) 6.9.1.001 jammy: sssd-ldap 2.6.3-1ubuntu3.9 (fixed in 2.6.3-1ubuntu3.9) 6.9.1.001 jammy: sssd-proxy 2.6.3-1ubuntu3.9 (fixed in 2.6.3-1ubuntu3.9) 6.9.1.001 jammy: sssd-tools 2.6.3-1ubuntu3.9 (fixed in 2.6.3-1ubuntu3.9) 6.9.0.464 jammy: libipa-hbac0 2.6.3-1ubuntu3.9 (fixed in 2.6.3-1ubuntu3.9) 6.9.0.464 jammy: libnss-sss 2.6.3-1ubuntu3.9 (fixed in 2.6.3-1ubuntu3.9) 6.9.0.464 jammy: libpam-sss 2.6.3-1ubuntu3.9 (fixed in 2.6.3-1ubuntu3.9) 6.9.0.464 jammy: libsss-certmap0 2.6.3-1ubuntu3.9 (fixed in 2.6.3-1ubuntu3.9) 6.9.0.464 jammy: libsss-idmap0 2.6.3-1ubuntu3.9 (fixed in 2.6.3-1ubuntu3.9) 6.9.0.464 jammy: libsss-nss-idmap0 2.6.3-1ubuntu3.9 (fixed in 2.6.3-1ubuntu3.9) 6.9.0.464 jammy: python3-sss 2.6.3-1ubuntu3.9 (fixed in 2.6.3-1ubuntu3.9) 6.9.0.464 jammy: sssd 2.6.3-1ubuntu3.9 (fixed in 2.6.3-1ubuntu3.9) 6.9.0.464 jammy: sssd-ad 2.6.3-1ubuntu3.9 (fixed in 2.6.3-1ubuntu3.9) 6.9.0.464 jammy: sssd-ad-common 2.6.3-1ubuntu3.9 (fixed in 2.6.3-1ubuntu3.9) 6.9.0.464 jammy: sssd-common 2.6.3-1ubuntu3.9 (fixed in 2.6.3-1ubuntu3.9) 6.9.0.464 jammy: sssd-ipa 2.6.3-1ubuntu3.9 (fixed in 2.6.3-1ubuntu3.9) 6.9.0.464 jammy: sssd-krb5 2.6.3-1ubuntu3.9 (fixed in 2.6.3-1ubuntu3.9) 6.9.0.464 jammy: sssd-krb5-common 2.6.3-1ubuntu3.9 (fixed in 2.6.3-1ubuntu3.9) 6.9.0.464 jammy: sssd-ldap 2.6.3-1ubuntu3.9 (fixed in 2.6.3-1ubuntu3.9) 6.9.0.464 jammy: sssd-proxy 2.6.3-1ubuntu3.9 (fixed in 2.6.3-1ubuntu3.9) 6.9.0.464 jammy: sssd-tools 2.6.3-1ubuntu3.9 (fixed in 2.6.3-1ubuntu3.9) 6.8.6.015 jammy: libipa-hbac0 2.6.3-1ubuntu3.9 (fixed in 2.6.3-1ubuntu3.9) 6.8.6.015 jammy: libnss-sss 2.6.3-1ubuntu3.9 (fixed in 2.6.3-1ubuntu3.9) 6.8.6.015 jammy: libpam-sss 2.6.3-1ubuntu3.9 (fixed in 2.6.3-1ubuntu3.9) 6.8.6.015 jammy: libsss-certmap0 2.6.3-1ubuntu3.9 (fixed in 2.6.3-1ubuntu3.9) 6.8.6.015 jammy: libsss-idmap0 2.6.3-1ubuntu3.9 (fixed in 2.6.3-1ubuntu3.9) 6.8.6.015 jammy: libsss-nss-idmap0 2.6.3-1ubuntu3.9 (fixed in 2.6.3-1ubuntu3.9) 6.8.6.015 jammy: python3-sss 2.6.3-1ubuntu3.9 (fixed in 2.6.3-1ubuntu3.9) 6.8.6.015 jammy: sssd 2.6.3-1ubuntu3.9 (fixed in 2.6.3-1ubuntu3.9) 6.8.6.015 jammy: sssd-ad 2.6.3-1ubuntu3.9 (fixed in 2.6.3-1ubuntu3.9) 6.8.6.015 jammy: sssd-ad-common 2.6.3-1ubuntu3.9 (fixed in 2.6.3-1ubuntu3.9) 6.8.6.015 jammy: sssd-common 2.6.3-1ubuntu3.9 (fixed in 2.6.3-1ubuntu3.9) 6.8.6.015 jammy: sssd-ipa 2.6.3-1ubuntu3.9 (fixed in 2.6.3-1ubuntu3.9) 6.8.6.015 jammy: sssd-krb5 2.6.3-1ubuntu3.9 (fixed in 2.6.3-1ubuntu3.9) 6.8.6.015 jammy: sssd-krb5-common 2.6.3-1ubuntu3.9 (fixed in 2.6.3-1ubuntu3.9) 6.8.6.015 jammy: sssd-ldap 2.6.3-1ubuntu3.9 (fixed in 2.6.3-1ubuntu3.9) 6.8.6.015 jammy: sssd-proxy 2.6.3-1ubuntu3.9 (fixed in 2.6.3-1ubuntu3.9) 6.8.6.015 jammy: sssd-tools 2.6.3-1ubuntu3.9 (fixed in 2.6.3-1ubuntu3.9) 6.8.5.018 jammy: libipa-hbac0 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.5.018 jammy: libnss-sss 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.5.018 jammy: libpam-sss 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.5.018 jammy: libsss-certmap0 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.5.018 jammy: libsss-idmap0 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.5.018 jammy: libsss-nss-idmap0 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.5.018 jammy: python3-sss 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.5.018 jammy: sssd 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.5.018 jammy: sssd-ad 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.5.018 jammy: sssd-ad-common 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.5.018 jammy: sssd-common 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.5.018 jammy: sssd-ipa 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.5.018 jammy: sssd-krb5 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.5.018 jammy: sssd-krb5-common 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.5.018 jammy: sssd-ldap 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.5.018 jammy: sssd-proxy 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.5.018 jammy: sssd-tools 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.4.038 jammy: libipa-hbac0 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.4.038 jammy: libnss-sss 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.4.038 jammy: libpam-sss 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.4.038 jammy: libsss-certmap0 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.4.038 jammy: libsss-idmap0 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.4.038 jammy: libsss-nss-idmap0 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.4.038 jammy: python3-sss 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.4.038 jammy: sssd 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.4.038 jammy: sssd-ad 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.4.038 jammy: sssd-ad-common 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.4.038 jammy: sssd-common 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.4.038 jammy: sssd-ipa 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.4.038 jammy: sssd-krb5 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.4.038 jammy: sssd-krb5-common 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.4.038 jammy: sssd-ldap 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.4.038 jammy: sssd-proxy 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.4.038 jammy: sssd-tools 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.3.018 jammy: libipa-hbac0 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.3.018 jammy: libnss-sss 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.3.018 jammy: libpam-sss 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.3.018 jammy: libsss-certmap0 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.3.018 jammy: libsss-idmap0 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.3.018 jammy: libsss-nss-idmap0 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.3.018 jammy: python3-sss 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.3.018 jammy: sssd 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.3.018 jammy: sssd-ad 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.3.018 jammy: sssd-ad-common 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.3.018 jammy: sssd-common 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.3.018 jammy: sssd-ipa 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.3.018 jammy: sssd-krb5 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.3.018 jammy: sssd-krb5-common 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.3.018 jammy: sssd-ldap 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.3.018 jammy: sssd-proxy 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.3.018 jammy: sssd-tools 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.2.002 jammy: libipa-hbac0 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.2.002 jammy: libnss-sss 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.2.002 jammy: libpam-sss 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.2.002 jammy: libsss-certmap0 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.2.002 jammy: libsss-idmap0 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.2.002 jammy: libsss-nss-idmap0 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.2.002 jammy: python3-sss 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.2.002 jammy: sssd 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.2.002 jammy: sssd-ad 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.2.002 jammy: sssd-ad-common 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.2.002 jammy: sssd-common 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.2.002 jammy: sssd-ipa 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.2.002 jammy: sssd-krb5 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.2.002 jammy: sssd-krb5-common 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.2.002 jammy: sssd-ldap 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.2.002 jammy: sssd-proxy 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.2.002 jammy: sssd-tools 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.1.007 jammy: libipa-hbac0 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.1.007 jammy: libnss-sss 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.1.007 jammy: libpam-sss 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.1.007 jammy: libsss-certmap0 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.1.007 jammy: libsss-idmap0 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.1.007 jammy: libsss-nss-idmap0 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.1.007 jammy: python3-sss 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.1.007 jammy: sssd 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.1.007 jammy: sssd-ad 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.1.007 jammy: sssd-ad-common 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.1.007 jammy: sssd-common 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.1.007 jammy: sssd-ipa 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.1.007 jammy: sssd-krb5 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.1.007 jammy: sssd-krb5-common 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.1.007 jammy: sssd-ldap 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.1.007 jammy: sssd-proxy 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.1.007 jammy: sssd-tools 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.0.205 jammy: libipa-hbac0 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.0.205 jammy: libnss-sss 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.0.205 jammy: libpam-sss 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.0.205 jammy: libsss-certmap0 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.0.205 jammy: libsss-idmap0 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.0.205 jammy: libsss-nss-idmap0 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.0.205 jammy: python3-sss 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.0.205 jammy: sssd 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.0.205 jammy: sssd-ad 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.0.205 jammy: sssd-ad-common 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.0.205 jammy: sssd-common 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.0.205 jammy: sssd-ipa 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.0.205 jammy: sssd-krb5 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.0.205 jammy: sssd-krb5-common 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.0.205 jammy: sssd-ldap 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.0.205 jammy: sssd-proxy 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) 6.8.0.205 jammy: sssd-tools 2.6.3-1ubuntu3.6 (fixed in 2.6.3-1ubuntu3.9) CVEs: CVE-2026-68743 References: https://ubuntu.com/security/notices/USN-8718-1