CVE:CVE-2021-3621
CNNVD:CNNVD-202108-1472
SSSD是一款提供本地或远程身份和身份验证资源访问的守护程序。
SSSD 存在操作系统命令注入漏洞，该漏洞源于在SSSD中发现了一个缺陷，sssctl命令很容易通过log -fetch和cache-expire子命令注入shell命令。攻击者可利用该漏洞诱骗用户运行一个特别设计的sssctl命令，来威胁系统的机密性、完整性以及系统可用性。
solution:Upgrade sssd sssd to a higher version than 2.6.0,and avoid the version 2.6.0; Upgrade redhat virtualization to a higher version than 4.0,and avoid the version 4.0; Upgrade redhat virtualization_host to a higher version than 4.0,and avoid the version 4.0; Upgrade redhat enterprise_linux to a higher version than 6.0,7.0,8.0,and avoid the version 6.0,7.0,8.0; Upgrade redhat enterprise_linux_eus to a higher version than 8.1,8.2,and avoid the version 8.1,8.2; Upgrade redhat enterprise_linux_server_aus to a higher version than 8.2,8.4,and avoid the version 8.2,8.4; Upgrade redhat enterprise_linux_server_tus to a higher version than 8.2,8.4,and avoid the version 8.2,8.4; Upgrade fedoraproject fedora to a higher version than 34,and avoid the version 34