A privilege escalation from host to domain vulnerability was found in the FreeIPA project. The FreeIPA package fails to validate the uniqueness of the `krbCanonicalName` for the admin account by default, allowing users to create services with the same canonical name as the REALM admin. When a successful attack happens, the user can retrieve a Kerberos ticket in the name of this service, containing the admin@REALM credential. This flaw allows an attacker to perform administrative tasks over the REALM, leading to access to sensitive data and sensitive data exfiltration.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python3-pyusbUpgrade ipa-server-encrypted-dnsUpgrade python3-qrcode-coreUpgrade python3-kdcproxyUpgrade opendnssecUpgrade ipa-selinux-lunaUpgrade ipa-server-trust-adUpgrade softhsmUpgrade ipa-python-compatUpgrade ipa-healthcheck-coreUpgrade python3-qrcodeUpgrade python3-custodiaUpgrade softhsm-develUpgrade slapi-nisUpgrade ipa-server-dnsUpgrade ipa-selinux-nfastUpgrade ipa-client-commonUpgrade python3-ipalibUpgrade ipa-server-commonUpgrade python3-ipaserverUpgrade python3-jwcryptoUpgrade ipa-client-epnUpgrade python3-ipaclientUpgrade ipa-selinuxUpgrade python3-ipatestsUpgrade ipa-client-encrypted-dnsUpgrade ipa-commonUpgrade ipa-serverUpgrade ipa-client-sambaUpgrade custodiaUpgrade ipa-healthcheckUpgrade ipa-clientUpgrade python3-yubicoUpgrade bind-dyndb-ldap | Jul 1, 2025 | Jun 17, 2025 |
| Amazon Linux Ami 2 | — | Upgrade ipa-python-compatUpgrade ipa-server-trust-adUpgrade ipa-debuginfoUpgrade ipa-commonUpgrade python2-ipalibUpgrade python2-ipaclientUpgrade ipa-serverUpgrade ipa-clientUpgrade ipa-client-commonUpgrade python2-ipaserverUpgrade ipa-server-dnsUpgrade ipa-server-common | Jun 25, 2025 | Jun 17, 2025 |
| Debian | — | Upgrade freeipa | Jun 20, 2025 | Jun 17, 2025 |
| Oracle_linux | — | Upgrade custodiaUpgrade python3-qrcode-coreUpgrade ipa-server-commonUpgrade ipa-commonUpgrade python3-ipaclientUpgrade python3-jwcryptoUpgrade python3-pyusbUpgrade python3-ipalibUpgrade python3-ipatestsUpgrade ipa-server-encrypted-dnsUpgrade bind-dyndb-ldapUpgrade python2-ipaserverUpgrade python3-ipaserverUpgrade ipa-client-commonUpgrade python3-qrcodeUpgrade ipa-client-sambaUpgrade softhsmUpgrade opendnssecUpgrade ipa-healthcheck-coreUpgrade ipa-server-dnsUpgrade ipa-healthcheckUpgrade python2-ipalibUpgrade python3-custodiaUpgrade python3-yubicoUpgrade ipa-client-encrypted-dnsUpgrade ipa-serverUpgrade ipa-selinux-nfastUpgrade ipa-selinuxUpgrade slapi-nisUpgrade ipa-client-epnUpgrade python3-kdcproxyUpgrade ipa-server-trust-adUpgrade ipa-selinux-lunaUpgrade ipa-python-compatUpgrade python2-ipaclientUpgrade ipa-clientUpgrade softhsm-devel | Jun 30, 2025 | Jun 17, 2025 |
| Redhat_linux | — | Upgrade python3-qrcode-coreUpgrade softhsmUpgrade python3-custodiaUpgrade python2-ipalibUpgrade ipa-server-dnsUpgrade ipa-debugsourceUpgrade ipa-debuginfoUpgrade python3-qrcodeUpgrade ipa-client-commonUpgrade opendnssec-debugsourceUpgrade ipa-server-trust-adUpgrade custodiaUpgrade ipa-python-compatUpgrade python3-pyusbUpgrade python2-ipaclientNo solution existsUpgrade python3-ipalibUpgrade python3-kdcproxyUpgrade ipa-client-debuginfoUpgrade ipa-server-debuginfoUpgrade bind-dyndb-ldapUpgrade ipa-selinux-nfastUpgrade ipa-server-commonUpgrade ipa-server-encrypted-dnsUpgrade softhsm-debugsourceUpgrade softhsm-develUpgrade ipa-healthcheck-coreUpgrade opendnssecUpgrade python3-ipaserverUpgrade python3-jwcryptoUpgrade python3-ipatestsUpgrade ipa-client-encrypted-dnsUpgrade ipa-serverUpgrade slapi-nis-debugsourceUpgrade ipa-selinuxUpgrade bind-dyndb-ldap-debuginfoUpgrade softhsm-debuginfoUpgrade python2-ipaserverUpgrade ipa-server-trust-ad-debuginfoUpgrade python3-ipaclientUpgrade python3-yubicoUpgrade slapi-nis-debuginfoUpgrade bind-dyndb-ldap-debugsourceUpgrade ipa-client-epnUpgrade slapi-nisUpgrade ipa-commonUpgrade ipa-client-sambaUpgrade opendnssec-debuginfoUpgrade ipa-selinux-lunaUpgrade ipa-healthcheckUpgrade ipa-client | Jun 18, 2025 | Jun 17, 2025 |
| Rocky_linux | — | Upgrade slapi-nis-debugsourceUpgrade ipa-debugsourceUpgrade ipa-server-debuginfoUpgrade opendnssec-debuginfoUpgrade ipa-server-trust-ad-debuginfoUpgrade softhsm-debugsourceUpgrade slapi-nisUpgrade ipa-server-trust-adUpgrade softhsm-debuginfoUpgrade opendnssec-debugsourceUpgrade ipa-server-encrypted-dnsUpgrade ipa-serverUpgrade ipa-debuginfoUpgrade ipa-client-sambaUpgrade ipa-client-debuginfoUpgrade bind-dyndb-ldap-debugsourceUpgrade ipa-clientUpgrade slapi-nis-debuginfoUpgrade softhsmUpgrade bind-dyndb-ldap-debuginfoUpgrade opendnssecUpgrade ipa-client-encrypted-dnsUpgrade softhsm-develUpgrade bind-dyndb-ldapUpgrade ipa-client-epn | Jul 31, 2025 | Jul 29, 2025 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub