We should apply a cosmetic fix to the nscd code, correcting an oversight in timeout handling introduced by the fix for RHEL-34271:

diff --git a/nscd/netgroupcache.c b/nscd/netgroupcache.c
index 4b35498e3f..5fdcf4204e 100644
--- a/nscd/netgroupcache.c
+++ b/nscd/netgroupcache.c
@@ -680,8 +680,8 @@ readdinnetgr (struct database_dyn *db, struct hashentry *he,
       .key_len = he->len
     };
 
-  int timeout = addinnetgrX (db, -1, &req, db->data + he->key, he->owner,
-                 he, dh);
+  time_t timeout = addinnetgrX (db, -1, &req, db->data + he->key, he->owner,
+                he, dh);
   if (timeout < 0)
     timeout = 0;
   return timeout;

Using int here should be harmless because the NSS service module does not control the timeout, and MAX_TIMEOUT_VALUE is not used. Valid timeout values are current time (in seconds since epoch) plus a few days at most (the default positive TTL is less than a day). This means that truncation does not happen during the supported time period of Red Hat Enterprise Linux 8, and the issue is cosmetic.

Upstream submission:

• [PATCH] nscd: Use time_t for return type of addgetnetgrentX