A Cross-site request forgery vulnerability exists in ipa/session/login_password in all supported versions of IPA. This flaw allows an attacker to trick the user into submitting a request that could perform actions as the user, resulting in a loss of confidentiality and system integrity. During community penetration testing it was found that for certain HTTP end-points FreeIPA does not ensure CSRF protection. Due to implementation details one cannot use this flaw for reflection of a cookie representing already logged-in user. An attacker would always have to go through a new authentication attempt.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade ipa-serverUpgrade softhsmUpgrade python3-yubicoUpgrade softhsm-develUpgrade python3-kdcproxyUpgrade ipa-commonUpgrade ipa-python-compatUpgrade ipa-clientUpgrade ipa-server-dnsUpgrade slapi-nisUpgrade python3-custodiaUpgrade python3-qrcode-coreUpgrade ipa-server-trust-adUpgrade ipa-client-epnUpgrade opendnssecUpgrade python3-ipaclientUpgrade python3-ipaserverUpgrade ipa-selinuxUpgrade python3-qrcodeUpgrade python3-ipatestsUpgrade ipa-client-commonUpgrade custodiaUpgrade ipa-healthcheckUpgrade bind-dyndb-ldapUpgrade python3-ipalibUpgrade ipa-client-sambaUpgrade python3-pyusbUpgrade ipa-healthcheck-coreUpgrade python3-jwcryptoUpgrade ipa-server-common | Jan 15, 2024 | Jan 10, 2024 |
| Amazon Linux Ami 2 | — | Upgrade ipa-clientUpgrade python2-ipalibUpgrade python2-ipaclientUpgrade ipa-serverUpgrade ipa-python-compatUpgrade ipa-debuginfoUpgrade ipa-server-dnsUpgrade python2-ipaserverUpgrade ipa-server-trust-adUpgrade ipa-client-commonUpgrade ipa-commonUpgrade ipa-server-common | Feb 21, 2024 | Jan 10, 2024 |
| Centos_linux | — | Upgrade ipa-commonUpgrade python2-ipaserverUpgrade ipa-server-commonUpgrade python2-ipaclientUpgrade ipa-server-trust-adUpgrade ipa-python-compatUpgrade ipa-clientUpgrade ipa-server-dnsUpgrade ipa-debuginfoUpgrade python2-ipalibUpgrade ipa-client-commonUpgrade ipa-server | Jan 11, 2024 | Jan 10, 2024 |
| Debian | — | Upgrade freeipa | May 15, 2025 | Jan 10, 2024 |
| Oracle_linux | — | Upgrade python2-ipalibUpgrade python2-ipaclientUpgrade python3-ipalibUpgrade python3-qrcode-coreUpgrade ipa-python-compatUpgrade ipa-server-commonUpgrade python3-qrcodeUpgrade ipa-client-commonUpgrade ipa-healthcheck-coreUpgrade python3-custodiaUpgrade python3-pyusbUpgrade slapi-nisUpgrade opendnssecUpgrade softhsmUpgrade ipa-server-dnsUpgrade ipa-server-trust-adUpgrade python3-kdcproxyUpgrade custodiaUpgrade softhsm-develUpgrade python3-ipaclientUpgrade ipa-client-sambaUpgrade ipa-clientUpgrade bind-dyndb-ldapUpgrade python3-yubicoUpgrade ipa-healthcheckUpgrade python3-jwcryptoUpgrade ipa-selinuxUpgrade ipa-serverUpgrade ipa-commonUpgrade ipa-client-epnUpgrade python3-ipatestsUpgrade python3-ipaserverUpgrade python2-ipaserver | Jan 11, 2024 | Jan 10, 2024 |
| Redhat_linux | — | Upgrade krb5-devel-debuginfoUpgrade softhsm-debuginfoUpgrade krb5-debugsourceUpgrade python3-qrcodeUpgrade krb5-debuginfoUpgrade krb5-pkinitUpgrade krb5-pkinit-debuginfoUpgrade python2-ipaserverUpgrade ipa-debugsourceUpgrade ipa-selinuxUpgrade krb5-workstation-debuginfoUpgrade python3-kdcproxyUpgrade python3-ipatestsUpgrade ipa-server-debuginfoUpgrade slapi-nis-debuginfoNo solution existsUpgrade ipa-healthcheck-coreUpgrade ipa-healthcheckUpgrade ipa-client-epnUpgrade bind-dyndb-ldap-debugsourceUpgrade custodiaUpgrade ipa-server-trust-ad-debuginfoUpgrade krb5-server-ldap-debuginfoUpgrade ipa-server-trust-adUpgrade python3-jwcryptoUpgrade python2-ipalibUpgrade opendnssecUpgrade krb5-serverUpgrade ipa-client-sambaUpgrade ipa-server-commonUpgrade slapi-nisUpgrade python3-ipaserverUpgrade ipa-serverUpgrade krb5-develUpgrade libkadm5-debuginfoUpgrade softhsm-develUpgrade slapi-nis-debugsourceUpgrade python3-pyusbUpgrade bind-dyndb-ldap-debuginfoUpgrade ipa-python-compatUpgrade python3-ipaclientUpgrade python3-custodiaUpgrade krb5-server-ldapUpgrade softhsmUpgrade ipa-client-commonUpgrade opendnssec-debugsourceUpgrade softhsm-debugsourceUpgrade python2-ipaclientUpgrade libkadm5Upgrade ipa-server-dnsUpgrade ipa-debuginfoUpgrade ipa-commonUpgrade ipa-client-debuginfoUpgrade krb5-libs-debuginfoUpgrade krb5-server-debuginfoUpgrade python3-ipalibUpgrade bind-dyndb-ldapUpgrade krb5-libsUpgrade python3-qrcode-coreUpgrade python3-yubicoUpgrade ipa-clientUpgrade opendnssec-debuginfoUpgrade krb5-workstation | Jan 11, 2024 | Jan 10, 2024 |
| Rocky_linux | — | Upgrade softhsm-debuginfoUpgrade softhsm-debugsourceUpgrade opendnssec-debugsourceUpgrade softhsm-develUpgrade softhsmUpgrade opendnssec-debuginfoUpgrade slapi-nis-debuginfoUpgrade slapi-nis-debugsourceUpgrade slapi-nisUpgrade opendnssec | Aug 15, 2024 | Jan 10, 2024 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub