A privilege escalation from host to domain vulnerability was found in the FreeIPA project. The FreeIPA package fails to validate the uniqueness of the `krbCanonicalName` for the admin account by default, allowing users to create services with the same canonical name as the REALM admin. When a successful attack happens, the user can retrieve a Kerberos ticket in the name of this service, containing the admin@REALM credential. This flaw allows an attacker to perform administrative tasks over the REALM, leading to access to sensitive data and sensitive data exfiltration.
CVSS Details
- CVSS 3.1 Base Score: 9.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade ipa-selinuxUpgrade ipa-client-sambaUpgrade ipa-serverUpgrade ipa-commonUpgrade python3-ipatestsUpgrade bind-dyndb-ldapUpgrade python3-ipaclientUpgrade python3-ipaserverUpgrade ipa-healthcheckUpgrade ipa-clientUpgrade ipa-client-encrypted-dnsUpgrade python3-jwcryptoUpgrade python3-yubicoUpgrade ipa-client-epnUpgrade custodiaUpgrade ipa-server-dnsUpgrade ipa-selinux-nfastUpgrade python3-qrcode-coreUpgrade opendnssecUpgrade ipa-server-commonUpgrade ipa-python-compatUpgrade ipa-selinux-lunaUpgrade ipa-server-trust-adUpgrade ipa-server-encrypted-dnsUpgrade python3-kdcproxyUpgrade python3-qrcodeUpgrade python3-pyusbUpgrade python3-ipalibUpgrade softhsm-develUpgrade python3-custodiaUpgrade slapi-nisUpgrade ipa-client-commonUpgrade ipa-healthcheck-coreUpgrade softhsm | Jul 1, 2025 | Jun 17, 2025 |
| Amazon Linux Ami 2 | — | Upgrade ipa-serverUpgrade ipa-client-commonUpgrade ipa-commonUpgrade python2-ipaclientUpgrade ipa-clientUpgrade ipa-python-compatUpgrade ipa-debuginfoUpgrade python2-ipalibUpgrade ipa-server-trust-adUpgrade python2-ipaserverUpgrade ipa-server-commonUpgrade ipa-server-dns | Jun 25, 2025 | Jun 17, 2025 |
| Debian | — | Upgrade freeipa | Jun 20, 2025 | Jun 17, 2025 |
| Oracle_linux | — | Upgrade python2-ipalibUpgrade ipa-server-dnsUpgrade ipa-selinuxUpgrade ipa-serverUpgrade python3-custodiaUpgrade ipa-client-encrypted-dnsUpgrade ipa-selinux-nfastUpgrade slapi-nisUpgrade ipa-server-trust-adUpgrade python2-ipaclientUpgrade ipa-python-compatUpgrade ipa-clientUpgrade ipa-healthcheckUpgrade softhsm-develUpgrade python3-kdcproxyUpgrade python3-yubicoUpgrade ipa-client-epnUpgrade ipa-selinux-lunaUpgrade ipa-healthcheck-coreUpgrade python2-ipaserverUpgrade python3-qrcodeUpgrade python3-ipatestsUpgrade python3-ipalibUpgrade python3-pyusbUpgrade custodiaUpgrade opendnssecUpgrade ipa-client-commonUpgrade python3-jwcryptoUpgrade python3-ipaclientUpgrade softhsmUpgrade ipa-commonUpgrade ipa-server-encrypted-dnsUpgrade python3-qrcode-coreUpgrade bind-dyndb-ldapUpgrade ipa-server-commonUpgrade ipa-client-sambaUpgrade python3-ipaserver | Jun 30, 2025 | Jun 17, 2025 |
| Redhat_linux | — | Upgrade python3-kdcproxyUpgrade opendnssecUpgrade ipa-healthcheck-coreUpgrade ipa-selinux-nfastUpgrade python3-custodiaNo solution existsUpgrade ipa-server-dnsUpgrade ipa-server-commonUpgrade python3-qrcode-coreUpgrade ipa-debuginfoUpgrade ipa-server-trust-adUpgrade opendnssec-debugsourceUpgrade ipa-debugsourceUpgrade softhsmUpgrade python2-ipalibUpgrade python3-ipalibUpgrade ipa-client-debuginfoUpgrade ipa-server-encrypted-dnsUpgrade ipa-server-debuginfoUpgrade python2-ipaclientUpgrade python3-pyusbUpgrade custodiaUpgrade ipa-python-compatUpgrade softhsm-develUpgrade ipa-client-commonUpgrade python3-qrcodeUpgrade softhsm-debugsourceUpgrade bind-dyndb-ldapUpgrade ipa-selinuxUpgrade ipa-healthcheckUpgrade ipa-clientUpgrade python3-ipaclientUpgrade opendnssec-debuginfoUpgrade python3-ipaserverUpgrade ipa-client-sambaUpgrade python3-jwcryptoUpgrade ipa-server-trust-ad-debuginfoUpgrade bind-dyndb-ldap-debuginfoUpgrade ipa-selinux-lunaUpgrade softhsm-debuginfoUpgrade slapi-nis-debugsourceUpgrade slapi-nis-debuginfoUpgrade python2-ipaserverUpgrade ipa-commonUpgrade python3-ipatestsUpgrade bind-dyndb-ldap-debugsourceUpgrade ipa-client-encrypted-dnsUpgrade ipa-serverUpgrade ipa-client-epnUpgrade slapi-nisUpgrade python3-yubico | Jun 18, 2025 | Jun 17, 2025 |
| Rocky_linux | — | Upgrade ipa-server-trust-ad-debuginfoUpgrade ipa-server-debuginfoUpgrade ipa-debugsourceUpgrade slapi-nis-debugsourceUpgrade slapi-nisUpgrade softhsm-debugsourceUpgrade opendnssec-debuginfoUpgrade opendnssec-debugsourceUpgrade ipa-server-trust-adUpgrade softhsm-debuginfoUpgrade ipa-client-sambaUpgrade ipa-clientUpgrade bind-dyndb-ldap-debugsourceUpgrade softhsmUpgrade ipa-server-encrypted-dnsUpgrade slapi-nis-debuginfoUpgrade ipa-client-debuginfoUpgrade bind-dyndb-ldapUpgrade ipa-debuginfoUpgrade ipa-client-epnUpgrade ipa-serverUpgrade bind-dyndb-ldap-debuginfoUpgrade ipa-client-encrypted-dnsUpgrade opendnssecUpgrade softhsm-devel | Jul 31, 2025 | Jul 29, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub