nathan/nixpkgs
1
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2026-07-21 16:11:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

sssd: patch CVE-2026-14476

Browse Source 
Backport the upstream 2.13 fix that rejects path traversal in gPCFileSysPath before GPO cache paths are constructed.

Assisted-by: pi coding agent / Mika (OpenAI gpt-5.6-sol)
(cherry picked from commit ee4b7e100e)
This commit is contained in:
Gerhard Schwanzer
2026-07-20 10:37:34 +02:00
committed by github-actions[bot]
parent 1cbbcdfe33
commit ca3498b029
1 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
pkgs/by-name/ss/sssd/package.nix
View File

@@ -2,6 +2,7 @@
lib,
stdenv,
fetchFromGitHub,
fetchpatch2,
autoreconfHook,
makeWrapper,
glibc,
@@ -78,6 +79,13 @@ stdenv.mkDerivation (finalAttrs: {
# Keep in mind to check /src/external/pac_responder.m4 for Kerberos compatibility before update Kerberos !!!
# Fix Kerberos Support version for PAC responder
#./fix-kerberos-version.patch
# Remove once a release containing this upstream fix is packaged.
(fetchpatch2 {
name = "CVE-2026-14476.patch";
url = "https://github.com/SSSD/sssd/commit/ba207eab76ff5253662a763b9b6e9ea42f03d31b.patch?full_index=1";
hash = "sha256-55V8RfIcGF49GGebg+pgCLPU9MGY2S/7PaOGIqwNL0w=";
})
];
postPatch = ''