A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way that FreeIPA's batch processing API logged operations. This included passing user passwords in clear text on FreeIPA masters. Batch processing of commands with passwords as arguments or options is not performed by default in FreeIPA but is possible by third-party components. An attacker having access to system logs on FreeIPA masters could use this flaw to produce log file content with passwords exposed.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
- CVSS 3.0 Base Score: 5.7
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade python2-ipaserverUpgrade ipa-server-trust-adUpgrade ipa-serverUpgrade ipa-commonUpgrade ipa-server-dnsUpgrade ipa-debuginfoUpgrade ipa-server-commonUpgrade ipa-python-compatUpgrade python2-ipalibUpgrade ipa-clientUpgrade python2-ipaclientUpgrade ipa-client-common | May 13, 2020 | Nov 27, 2019 |
| Centos_linux | — | Upgrade python2-ipaclientUpgrade ipa-server-dnsUpgrade ipa-server-trust-adUpgrade python2-ipaserverUpgrade ipa-client-commonUpgrade ipa-debuginfoUpgrade ipa-python-compatUpgrade ipa-commonUpgrade ipa-serverUpgrade ipa-clientUpgrade python2-ipalibUpgrade ipa-server-common | Feb 5, 2020 | Nov 27, 2019 |
| Debian | — | Upgrade freeipa | Jul 30, 2024 | Nov 27, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade python2-ipaclientUpgrade python2-ipaserverUpgrade ipa-server-trust-adUpgrade ipa-admintoolsUpgrade ipa-server-dnsUpgrade ipa-serverUpgrade python2-ipalibUpgrade ipa-server-commonUpgrade ipa-client-commonUpgrade ipa-clientUpgrade ipa-common | Apr 16, 2020 | Nov 27, 2019 |
| Oracle_linux | — | Upgrade ipa-clientUpgrade ipa-commonUpgrade ipa-server-dnsUpgrade python2-ipaserverUpgrade ipa-python-compatUpgrade ipa-serverUpgrade ipa-server-commonUpgrade python2-ipaclientUpgrade ipa-client-commonUpgrade python2-ipalibUpgrade ipa-server-trust-ad | Feb 6, 2020 | Nov 26, 2019 |
| Redhat_linux | — | Upgrade python2-ipalibUpgrade python2-ipaserverUpgrade ipa-server-trust-adNo solution existsUpgrade ipa-debuginfoUpgrade python2-ipaclientUpgrade ipa-python-compatUpgrade ipa-serverUpgrade ipa-client-commonUpgrade ipa-server-commonUpgrade ipa-clientUpgrade ipa-commonUpgrade ipa-server-dns | Feb 5, 2020 | Nov 27, 2019 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Nov 27, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub