A flaw was found in the FreeIPA API audit, where it sends the whole FreeIPA command line to journalctl. As a consequence, during the FreeIPA installation process, it inadvertently leaks the administrative user credentials, including the administrator password, to the journal database. In the worst-case scenario, where the journal log is centralized, users with access to it can have improper access to the FreeIPA administrator credentials.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python3-ipalibUpgrade python3-ipatestsUpgrade python3-ipaclientUpgrade ipa-selinuxUpgrade ipa-serverUpgrade ipa-server-trust-adUpgrade ipa-client-sambaUpgrade python3-ipaserverUpgrade ipa-client-epnUpgrade ipa-server-commonUpgrade ipa-commonUpgrade ipa-selinux-nfastUpgrade ipa-client-commonUpgrade ipa-selinux-lunaUpgrade ipa-clientUpgrade ipa-server-dns | Jan 20, 2025 | Jan 15, 2025 |
| Debian | — | No solution existsUpgrade freeipa | May 15, 2025 | Jan 15, 2025 |
| Oracle_linux | — | Upgrade ipa-client-epnUpgrade python3-ipaclientUpgrade ipa-client-sambaUpgrade ipa-server-dnsUpgrade ipa-server-commonUpgrade ipa-client-commonUpgrade ipa-commonUpgrade ipa-serverUpgrade ipa-selinux-lunaUpgrade python3-ipaserverUpgrade ipa-clientUpgrade ipa-selinux-nfastUpgrade ipa-selinuxUpgrade ipa-server-trust-adUpgrade python3-ipatestsUpgrade python3-ipalib | Jan 16, 2025 | Jan 15, 2025 |
| Redhat_linux | — | Upgrade ipa-debuginfoUpgrade ipa-debugsourceUpgrade ipa-server-commonUpgrade ipa-client-commonUpgrade ipa-selinux-nfastUpgrade ipa-server-debuginfoUpgrade ipa-client-debuginfoUpgrade ipa-server-trust-adUpgrade python3-ipalibUpgrade ipa-server-dnsUpgrade ipa-selinux-lunaUpgrade ipa-clientUpgrade ipa-client-sambaUpgrade python3-ipatestsUpgrade ipa-server-trust-ad-debuginfoUpgrade ipa-serverUpgrade ipa-selinuxUpgrade python3-ipaserverUpgrade ipa-client-epnUpgrade python3-ipaclientUpgrade ipa-common | Jan 16, 2025 | Jan 15, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub