A flaw was found in the FreeIPA API audit, where it sends the whole FreeIPA command line to journalctl. As a consequence, during the FreeIPA installation process, it inadvertently leaks the administrative user credentials, including the administrator password, to the journal database. In the worst-case scenario, where the journal log is centralized, users with access to it can have improper access to the FreeIPA administrator credentials.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python3-ipaclientUpgrade python3-ipatestsUpgrade ipa-selinuxUpgrade python3-ipalibUpgrade ipa-clientUpgrade ipa-selinux-nfastUpgrade ipa-server-commonUpgrade python3-ipaserverUpgrade ipa-client-sambaUpgrade ipa-server-dnsUpgrade ipa-client-epnUpgrade ipa-client-commonUpgrade ipa-commonUpgrade ipa-serverUpgrade ipa-server-trust-adUpgrade ipa-selinux-luna | Jan 20, 2025 | Jan 15, 2025 |
| Debian | — | No solution existsUpgrade freeipa | May 15, 2025 | Jan 15, 2025 |
| Oracle_linux | — | Upgrade ipa-selinuxUpgrade ipa-selinux-nfastUpgrade ipa-server-trust-adUpgrade ipa-selinux-lunaUpgrade ipa-clientUpgrade python3-ipalibUpgrade ipa-serverUpgrade python3-ipaserverUpgrade python3-ipatestsUpgrade ipa-commonUpgrade ipa-client-sambaUpgrade ipa-server-commonUpgrade ipa-client-epnUpgrade ipa-client-commonUpgrade python3-ipaclientUpgrade ipa-server-dns | Jan 16, 2025 | Jan 15, 2025 |
| Redhat_linux | — | Upgrade ipa-clientUpgrade ipa-server-trust-ad-debuginfoUpgrade ipa-client-epnUpgrade ipa-selinuxUpgrade python3-ipaserverUpgrade ipa-selinux-nfastUpgrade ipa-server-debuginfoUpgrade ipa-client-sambaUpgrade python3-ipalibUpgrade ipa-server-dnsUpgrade ipa-debugsourceUpgrade ipa-selinux-lunaUpgrade ipa-debuginfoUpgrade ipa-client-commonUpgrade ipa-client-debuginfoUpgrade ipa-server-trust-adUpgrade ipa-server-commonUpgrade python3-ipatestsUpgrade ipa-serverUpgrade ipa-commonUpgrade python3-ipaclient | Jan 16, 2025 | Jan 15, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub