A vulnerability was found in FreeIPA in how the initial implementation of MS-SFU by MIT Kerberos was missing a condition for granting the "forwardable" flag on S4U2Self tickets. Fixing this mistake required adding a special case for the check_allowed_to_delegate() function: If the target service argument is NULL, then it means the KDC is probing for general constrained delegation rules and not checking a specific S4U2Proxy request. In FreeIPA 4.11.0, the behavior of ipadb_match_acl() was modified to match the changes from upstream MIT Kerberos 1.20. However, a mistake resulting in this mechanism applies in cases where the target service argument is set AND where it is unset. This results in S4U2Proxy requests being accepted regardless of whether or not there is a matching service delegation rule.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade ipa-server-dnsUpgrade python3-qrcodeUpgrade python3-kdcproxyUpgrade opendnssecUpgrade ipa-clientUpgrade custodiaUpgrade python3-custodiaUpgrade softhsm-develUpgrade ipa-server-commonUpgrade python3-pyusbUpgrade softhsmUpgrade ipa-client-commonUpgrade ipa-python-compatUpgrade python3-qrcode-coreUpgrade python3-ipalibUpgrade bind-dyndb-ldapUpgrade ipa-server-trust-adUpgrade ipa-healthcheck-coreUpgrade python3-yubicoUpgrade ipa-client-sambaUpgrade slapi-nisUpgrade python3-ipaclientUpgrade python3-jwcryptoUpgrade ipa-client-epnUpgrade ipa-commonUpgrade ipa-serverUpgrade python3-ipaserverUpgrade python3-ipatestsUpgrade ipa-healthcheckUpgrade ipa-selinux | Jun 24, 2024 | Jun 12, 2024 |
| Debian | — | Upgrade freeipa | May 15, 2025 | Jun 12, 2024 |
| Oracle_linux | — | Upgrade softhsmUpgrade python3-kdcproxyUpgrade ipa-healthcheck-coreUpgrade ipa-client-epnUpgrade ipa-server-dnsUpgrade python3-qrcodeUpgrade python3-pyusbUpgrade ipa-client-commonUpgrade bind-dyndb-ldapUpgrade python3-ipaclientUpgrade ipa-server-trust-adUpgrade ipa-clientUpgrade python3-jwcryptoUpgrade python3-ipatestsUpgrade python3-ipalibUpgrade python3-yubicoUpgrade python3-qrcode-coreUpgrade custodiaUpgrade python3-ipaserverUpgrade ipa-healthcheckUpgrade ipa-serverUpgrade python3-custodiaUpgrade slapi-nisUpgrade opendnssecUpgrade ipa-server-commonUpgrade ipa-selinuxUpgrade ipa-commonUpgrade softhsm-develUpgrade ipa-client-sambaUpgrade ipa-python-compat | Jul 22, 2024 | Jun 10, 2024 |
| Redhat_linux | — | Upgrade ipa-debugsourceUpgrade ipa-server-trust-adUpgrade python3-ipaclientUpgrade python3-ipalibUpgrade ipa-server-commonUpgrade ipa-client-sambaUpgrade python3-ipatestsUpgrade ipa-selinuxUpgrade ipa-server-trust-ad-debuginfoUpgrade ipa-server-dnsUpgrade ipa-commonUpgrade ipa-clientUpgrade ipa-client-epnUpgrade ipa-debuginfoUpgrade ipa-serverUpgrade ipa-client-commonUpgrade ipa-client-debuginfoUpgrade ipa-server-debuginfoNo solution existsUpgrade python3-ipaserver | Jun 20, 2024 | Jun 12, 2024 |
| Rocky_linux | — | Upgrade ipa-debugsourceUpgrade ipa-server-debuginfoUpgrade ipa-debuginfoUpgrade softhsmUpgrade ipa-server-trust-adUpgrade slapi-nisUpgrade ipa-serverUpgrade opendnssecUpgrade slapi-nis-debugsourceUpgrade softhsm-develUpgrade opendnssec-debuginfoUpgrade ipa-clientUpgrade ipa-client-epnUpgrade ipa-client-sambaUpgrade opendnssec-debugsourceUpgrade ipa-server-trust-ad-debuginfoUpgrade slapi-nis-debuginfoUpgrade softhsm-debuginfoUpgrade ipa-client-debuginfoUpgrade bind-dyndb-ldapUpgrade bind-dyndb-ldap-debugsourceUpgrade bind-dyndb-ldap-debuginfoUpgrade softhsm-debugsource | Jun 17, 2024 | Jun 12, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub