CVE-2018-16883: Fedoraproject Sssd

Medium severity, CVSS 5.5. EPSS: 0.4% chance of exploitation in the next 30 days.

sssd versions from 1.13.0 to before 2.0.0 did not properly restrict access to the infopipe according to the "allowed_uids" configuration parameter. If sensitive information were stored in the user directory, this could be inadvertently disclosed to local attackers.

Affected products

• Fedoraproject Sssd: from 1.13.0, before 2.0.0 (fixed in 2.0.0)

Published 2018-12-19. Last modified 2026-06-17.