A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way that FreeIPA's batch processing API logged operations. This included passing user passwords in clear text on FreeIPA masters. Batch processing of commands with passwords as arguments or options is not performed by default in FreeIPA but is possible by third-party components. An attacker having access to system logs on FreeIPA masters could use this flaw to produce log file content with passwords exposed.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
- CVSS 3.0 Base Score: 5.7
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade python2-ipaserverUpgrade ipa-server-trust-adUpgrade ipa-debuginfoUpgrade python2-ipaclientUpgrade ipa-server-commonUpgrade ipa-server-dnsUpgrade ipa-clientUpgrade ipa-commonUpgrade ipa-serverUpgrade ipa-client-commonUpgrade python2-ipalibUpgrade ipa-python-compat | May 13, 2020 | Nov 27, 2019 |
| Centos_linux | — | Upgrade ipa-server-commonUpgrade ipa-client-commonUpgrade ipa-python-compatUpgrade ipa-clientUpgrade python2-ipalibUpgrade ipa-serverUpgrade ipa-commonUpgrade ipa-debuginfoUpgrade python2-ipaserverUpgrade ipa-server-dnsUpgrade ipa-server-trust-adUpgrade python2-ipaclient | Feb 5, 2020 | Nov 27, 2019 |
| Debian | — | Upgrade freeipa | Jul 30, 2024 | Nov 27, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade python2-ipalibUpgrade ipa-server-dnsUpgrade ipa-commonUpgrade ipa-clientUpgrade ipa-client-commonUpgrade ipa-server-commonUpgrade ipa-serverUpgrade python2-ipaserverUpgrade ipa-admintoolsUpgrade python2-ipaclientUpgrade ipa-server-trust-ad | Apr 16, 2020 | Nov 27, 2019 |
| Oracle_linux | — | Upgrade ipa-commonUpgrade ipa-clientUpgrade ipa-server-dnsUpgrade ipa-client-commonUpgrade ipa-server-commonUpgrade ipa-server-trust-adUpgrade python2-ipalibUpgrade python2-ipaserverUpgrade python2-ipaclientUpgrade ipa-python-compatUpgrade ipa-server | Feb 6, 2020 | Nov 26, 2019 |
| Redhat_linux | — | Upgrade ipa-commonUpgrade ipa-clientUpgrade ipa-server-dnsUpgrade ipa-python-compatUpgrade ipa-debuginfoUpgrade python2-ipalibUpgrade ipa-server-trust-adUpgrade ipa-client-commonUpgrade python2-ipaclientUpgrade ipa-server-commonUpgrade ipa-serverUpgrade python2-ipaserverNo solution exists | Feb 5, 2020 | Nov 27, 2019 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Nov 27, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub