A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way that FreeIPA's batch processing API logged operations. This included passing user passwords in clear text on FreeIPA masters. Batch processing of commands with passwords as arguments or options is not performed by default in FreeIPA but is possible by third-party components. An attacker having access to system logs on FreeIPA masters could use this flaw to produce log file content with passwords exposed.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
- CVSS 3.0 Base Score: 5.7
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade python2-ipalibUpgrade python2-ipaclientUpgrade ipa-debuginfoUpgrade ipa-python-compatUpgrade ipa-server-dnsUpgrade ipa-commonUpgrade ipa-server-commonUpgrade ipa-clientUpgrade ipa-client-commonUpgrade ipa-serverUpgrade python2-ipaserverUpgrade ipa-server-trust-ad | May 13, 2020 | Nov 27, 2019 |
| Centos_linux | — | Upgrade ipa-server-dnsUpgrade ipa-server-trust-adUpgrade python2-ipaclientUpgrade python2-ipaserverUpgrade ipa-debuginfoUpgrade python2-ipalibUpgrade ipa-client-commonUpgrade ipa-python-compatUpgrade ipa-clientUpgrade ipa-commonUpgrade ipa-server-commonUpgrade ipa-server | Feb 5, 2020 | Nov 27, 2019 |
| Debian | — | Upgrade freeipa | Jul 30, 2024 | Nov 27, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade python2-ipalibUpgrade ipa-commonUpgrade ipa-admintoolsUpgrade python2-ipaserverUpgrade python2-ipaclientUpgrade ipa-server-trust-adUpgrade ipa-server-dnsUpgrade ipa-serverUpgrade ipa-clientUpgrade ipa-client-commonUpgrade ipa-server-common | Apr 16, 2020 | Nov 27, 2019 |
| Oracle_linux | — | Upgrade ipa-client-commonUpgrade python2-ipaclientUpgrade ipa-server-commonUpgrade ipa-serverUpgrade python2-ipalibUpgrade ipa-python-compatUpgrade python2-ipaserverUpgrade ipa-server-trust-adUpgrade ipa-server-dnsUpgrade ipa-clientUpgrade ipa-common | Feb 6, 2020 | Nov 26, 2019 |
| Redhat_linux | — | Upgrade ipa-debuginfoUpgrade ipa-client-commonUpgrade python2-ipaclientUpgrade ipa-serverUpgrade ipa-server-commonUpgrade python2-ipalibUpgrade ipa-server-trust-adUpgrade ipa-python-compatUpgrade python2-ipaserverNo solution existsUpgrade ipa-commonUpgrade ipa-server-dnsUpgrade ipa-client | Feb 5, 2020 | Nov 27, 2019 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Nov 27, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub