CVE-2025-59044

{
  "id": "CVE-2025-59044",
  "sourceIdentifier": "[email protected]",
  "published": "2025-09-09T23:15:37.583",
  "lastModified": "2026-10-19T17:10:00.173",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Himmelblau 0.9.x derives numeric GIDs for Entra ID groups from the group display name when himmelblau.conf `id_attr_map = name` (the default configuration). Because Microsoft Entra ID allows multiple groups with the same `displayName` (including end-user–created personal/O365 groups, depending on tenant policy), distinct directory groups can collapse to the same numeric GID on Linux. This issue only applies to Himmelblau versions 0.9.0 through 0.9.22. Any resource or service on a Himmelblau-joined host that enforces authorization by numeric GID (files/dirs, etc.) can be unintentionally accessible to a user who creates or joins a different Entra/O365 group that happens to share the same `displayName` as a privileged security group. Users should upgrade to 0.9.23, or 1.0.0 or later, to receive a patch. Group to GID mapping now uses Entra ID object IDs (GUIDs) and does not collide on same-name groups. As a workaround, use tenant policy hardening to restrict arbitrary group creation until all hosts are patched."
    },
    {
      "lang": "es",
      "value": "Himmelblau es una suite de interoperabilidad para Microsoft Azure Entra ID e Intune. Himmelblau 0.9.x deriva GIDs numéricos para grupos de Entra ID del nombre para mostrar del grupo cuando himmelblau.conf 'id_attr_map = name' (la configuración predeterminada). Debido a que Microsoft Entra ID permite múltiples grupos con el mismo 'displayName' (incluidos los grupos personales/O365 creados por el usuario final, dependiendo de la política del inquilino), grupos de directorio distintos pueden colapsar en el mismo GID numérico en Linux. Este problema solo se aplica a las versiones de Himmelblau 0.9.0 a 0.9.22. Cualquier recurso o servicio en un host unido a Himmelblau que aplique la autorización por GID numérico (archivos/directorios, etc.) puede ser accesible de forma no intencionada para un usuario que cree o se una a un grupo diferente de Entra/O365 que casualmente comparta el mismo 'displayName' que un grupo de seguridad privilegiado. Los usuarios deben actualizar a 0.9.23, o 1.0.0 o posterior, para recibir un parche. El mapeo de grupo a GID ahora utiliza IDs de objeto de Entra ID (GUIDs) y no colisiona en grupos con el mismo nombre. Como solución alternativa, utilice el endurecimiento de la política del inquilino para restringir la creación arbitraria de grupos hasta que todos los hosts estén parcheados."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "himmelblau-idm",
          "product": "himmelblau",
          "versions": [
            {
              "version": ">= 0.9.0, < 0.9.23",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
          "baseScore": 4.4,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 2.5
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-09-10T15:55:27.654941Z",
          "id": "CVE-2025-59044",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1188"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/himmelblau-idm/himmelblau/commit/76c5b41df7f89378af65dc7c0d0484d7d41b3281",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/himmelblau-idm/himmelblau/security/advisories/GHSA-2m43-mmg9-3rgc",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/himmelblau-idm/himmelblau/security/advisories/GHSA-gcxr-m95v-qcf7",
      "source": "[email protected]"
    }
  ]
}