CVE-2026-34397

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. From versions 2.0.0-alpha to before 2.3.9 and 3.0.0-alpha to before 3.1.1, there is a conditional local privilege escalation vulnerability in an edge-case naming collision. Only authenticated himmelblau users whose mapped CN/short name exactly matches a privileged local group name (e.g., "sudo", "wheel", "docker", "adm") can cause the NSS module to resolve that group name to their fake primary group. If the system uses NSS results for group-based authorization decisions (sudo, polkit, etc.), this can grant the attacker the privileges of that group. This issue has been patched in versions 2.3.9 and 3.1.1.

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. From versions 2.0.0-alpha to before 2.3.9 and 3.0.0-alpha to before 3.1.1, there is a conditional local privilege escalation vulnerability in an edge-case naming collision. Only authenticated himmelblau users whose mapped CN/short name exactly matches a privileged local group name (e.g., "sudo", "wheel", "docker", "adm") can cause the NSS module to resolve that group name to their fake primary group. If the system uses NSS results for group-based authorization decisions (sudo, polkit, etc.), this can grant the attacker the privileges of that group. This issue has been patched in versions 2.3.9 and 3.1.1.

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. From versions 2.0.0-alpha to before 2.3.9 and 3.0.0-alpha to before 3.1.1, there is a conditional local privilege escalation vulnerability in an edge-case naming collision. Only authenticated himmelblau users whose mapped CN/short name exactly matches a privileged local group name (e.g., "sudo", "wheel", "docker", "adm") can cause the NSS module to resolve that group name to their fake primary group. If the system uses NSS results for group-based authorization decisions (sudo, polkit, etc.), this can grant the attacker the privileges of that group. This issue has been patched in versions 2.3.9 and 3.1.1.

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. From versions 2.0.0-alpha to before 2.3.9 and 3.0.0-alpha to before 3.1.1, there is a conditional local privilege escalation vulnerability in an edge-case naming collision. Only authenticated himmelblau users whose mapped CN/short name exactly matches a privileged local group name (e.g., "sudo", "wheel", "docker", "adm") can cause the NSS module to resolve that group name to their fake primary group. If the system uses NSS results for group-based authorization decisions (sudo, polkit, etc.), this can grant the attacker the privileges of that group. This issue has been patched in versions 2.3.9 and 3.1.1.

These are all security issues fixed in the himmelblau-2.3.9+git0.a9fd29b-1.1 package on the GA media of openSUSE Tumbleweed.

This update for himmelblau fixes the following issues:

Update to version 2.3.9+git0.a9fd29b.

Security issues fixed:

• CVE-2026-34397: Fixed naming collision that can lead to local privilege escalation (bsc#1261324).

Other updates and bugfixes:

• update aws-lc-sys to 0.39.0 for security fixes
• update rustls-webpki to 0.103.10 for CRL revocation fix
• Version 2.3.9:
  • packaging: fix if/else block for debian's postrm
  • Update apparmor.unix-chkpwd.local (Issue #1252)
  • When Hello user encounters SSPR demand, be permissive
  • add tests for sudo_groups functionality
  • Fix config tests to ignore local host config
  • Do not clear $NOTIFY_SOCKET when calling sd_ready
  • Fix token cache 24h purge
  • broker: use SSO server nonce for PRT only when provided
  • Fix pam_himmelblau blocking local user password changes (#1199)
  • Remove unused File import
  • Use is_ascii_alphanumeric() for account_id validation
  • Fix path traversal in LoadProfilePhoto AccountsService writes
  • Drop initialization tracing span
  • himmelblau-hsm-pin-init: drop RemainAfterExit=yes
  • Add fallback behavior when consent is required
  • qr-greeter: enable extension without socket noise
  • debian: make install/remove noninteractive; reduce QR postinst noise; soften missing hello prt
  • Never respond with BadRequest without error detail
  • deps(rust): bump the all-cargo-updates group across 1 directory with 7 updates

This update for himmelblau fixes the following issues:

Update to version 2.3.9+git0.a9fd29b; (jsc#PED-14511):

• CVE-2026-34397: Fix LPE due to name collision during NSS fake-primary group lookup (bsc#1261324).
• CVE-2026-31979: Fix race condition when accessiung /tmp/krb5cc_uid (bsc#1259548).
• CVE-2026-25727: deps(rust): Bump the all-cargo-updates group with 8 updates (bsc#1257904).
• CVE-2025-58160: deps(rust): Bump tracing-subscriber in the cargo group (bsc#1249013).
• CVE-2025-54882: Fix Kerberos credential cache permissions (bsc#1247735).
• CVE-2025-53013: Fix permitted authentication with invalid Hello PIN (bsc#1245437).
• CVE-2024-11738: Fix rustls network-reachable panic in Acceptor::accept (bsc#1233949).

Other bug fixes:

• Fix SELinux module packaging to use standard policy macros (bsc#1258236).

This update for himmelblau fixes the following issues:

Update to version 2.3.9+git0.a9fd29b.

Security issues fixed:

• CVE-2026-34397: Fixed naming collision that can lead to local privilege escalation (bsc#1261324).

Other updates and bugfixes:

• update aws-lc-sys to 0.39.0 for security fixes
• update rustls-webpki to 0.103.10 for CRL revocation fix
• Version 2.3.9:
  • packaging: fix if/else block for debian's postrm
  • Update apparmor.unix-chkpwd.local (Issue #1252)
  • When Hello user encounters SSPR demand, be permissive
  • add tests for sudo_groups functionality
  • Fix config tests to ignore local host config
  • Do not clear $NOTIFY_SOCKET when calling sd_ready
  • Fix token cache 24h purge
  • broker: use SSO server nonce for PRT only when provided
  • Fix pam_himmelblau blocking local user password changes (#1199)
  • Remove unused File import
  • Use is_ascii_alphanumeric() for account_id validation
  • Fix path traversal in LoadProfilePhoto AccountsService writes
  • Drop initialization tracing span
  • himmelblau-hsm-pin-init: drop RemainAfterExit=yes
  • Add fallback behavior when consent is required
  • qr-greeter: enable extension without socket noise
  • debian: make install/remove noninteractive; reduce QR postinst noise; soften missing hello prt
  • Never respond with BadRequest without error detail
  • deps(rust): bump the all-cargo-updates group across 1 directory with 7 updates