Debian 10: DLA-3436-1 Moderate: SSSD Privilege Escalation Threats

It was discovered that when the Group Policy Objects (GPO) are not
readable by SSSD due to a too strict permission settings on the
server side, SSSD allows all authenticated users to login instead of
denying access.

A new boolean setting ‘ad_gpo_ignore_unreadable’ (defaulting to
False) is introduced for environments where attributes in the
groupPolicyContainer are not readable and changing the permissions
on the GPO objects is not possible or desirable. See sssd-ad(5).

CVE-2019-3811

It was discovered that if a user was configured with no home
directory set, then sssd(8) returns ‘/’ (i.e., the root directory)
instead of the empty string (meaning no home directory). This could
impact services that restrict the user's filesystem access to within
their home directory through chroot() or similar.

CVE-2021-3621

It was discovered that the sssctl(8) command was vulnerable to shell