A flaw was found in the FreeIPA API audit, where it sends the whole FreeIPA command line to journalctl. As a consequence, during the FreeIPA installation process, it inadvertently leaks the administrative user credentials, including the administrator password, to the journal database. In the worst-case scenario, where the journal log is centralized, users with access to it can have improper access to the FreeIPA administrator credentials.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade ipa-server-commonUpgrade ipa-server-trust-adUpgrade ipa-selinux-nfastUpgrade ipa-server-dnsUpgrade ipa-client-epnUpgrade ipa-client-sambaUpgrade python3-ipaserverUpgrade ipa-commonUpgrade ipa-client-commonUpgrade ipa-selinux-lunaUpgrade ipa-clientUpgrade ipa-serverUpgrade python3-ipaclientUpgrade python3-ipatestsUpgrade python3-ipalibUpgrade ipa-selinux | Jan 20, 2025 | Jan 15, 2025 |
| Debian | — | No solution existsUpgrade freeipa | May 15, 2025 | Jan 15, 2025 |
| Oracle_linux | — | Upgrade ipa-server-commonUpgrade ipa-client-epnUpgrade ipa-client-commonUpgrade ipa-server-dnsUpgrade ipa-client-sambaUpgrade python3-ipaclientUpgrade ipa-clientUpgrade ipa-commonUpgrade python3-ipalibUpgrade ipa-selinux-lunaUpgrade python3-ipatestsUpgrade ipa-server-trust-adUpgrade python3-ipaserverUpgrade ipa-serverUpgrade ipa-selinuxUpgrade ipa-selinux-nfast | Jan 16, 2025 | Jan 15, 2025 |
| Redhat_linux | — | Upgrade ipa-client-debuginfoUpgrade ipa-server-debuginfoUpgrade ipa-server-commonUpgrade ipa-debugsourceUpgrade ipa-client-commonUpgrade ipa-debuginfoUpgrade ipa-selinux-nfastUpgrade ipa-server-trust-adUpgrade python3-ipalibUpgrade ipa-server-dnsUpgrade ipa-selinux-lunaUpgrade ipa-server-trust-ad-debuginfoUpgrade ipa-serverUpgrade ipa-clientUpgrade python3-ipatestsUpgrade python3-ipaclientUpgrade ipa-selinuxUpgrade ipa-client-epnUpgrade python3-ipaserverUpgrade ipa-client-sambaUpgrade ipa-common | Jan 16, 2025 | Jan 15, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub