A privilege escalation from host to domain vulnerability was found in the FreeIPA project. The FreeIPA package fails to validate the uniqueness of the `krbCanonicalName` for the admin account by default, allowing users to create services with the same canonical name as the REALM admin. When a successful attack happens, the user can retrieve a Kerberos ticket in the name of this service, containing the admin@REALM credential. This flaw allows an attacker to perform administrative tasks over the REALM, leading to access to sensitive data and sensitive data exfiltration.
CVSS Details
- CVSS 3.1 Base Score: 9.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade ipa-selinuxUpgrade python3-ipaserverUpgrade python3-ipaclientUpgrade python3-jwcryptoUpgrade ipa-client-epnUpgrade ipa-commonUpgrade python3-ipatestsUpgrade bind-dyndb-ldapUpgrade ipa-client-encrypted-dnsUpgrade custodiaUpgrade python3-yubicoUpgrade ipa-healthcheckUpgrade ipa-client-sambaUpgrade ipa-clientUpgrade ipa-serverUpgrade ipa-selinux-nfastUpgrade ipa-server-dnsUpgrade python3-qrcodeUpgrade slapi-nisUpgrade python3-custodiaUpgrade softhsm-develUpgrade ipa-server-trust-adUpgrade ipa-selinux-lunaUpgrade python3-pyusbUpgrade python3-kdcproxyUpgrade python3-qrcode-coreUpgrade ipa-healthcheck-coreUpgrade softhsmUpgrade ipa-server-commonUpgrade opendnssecUpgrade python3-ipalibUpgrade ipa-server-encrypted-dnsUpgrade ipa-client-commonUpgrade ipa-python-compat | Jul 1, 2025 | Jun 17, 2025 |
| Amazon Linux Ami 2 | — | Upgrade ipa-server-trust-adUpgrade python2-ipalibUpgrade ipa-debuginfoUpgrade ipa-client-commonUpgrade python2-ipaclientUpgrade ipa-commonUpgrade ipa-serverUpgrade ipa-python-compatUpgrade ipa-clientUpgrade ipa-server-dnsUpgrade ipa-server-commonUpgrade python2-ipaserver | Jun 25, 2025 | Jun 17, 2025 |
| Debian | — | No solution existsUpgrade freeipa | Jun 20, 2025 | Jun 17, 2025 |
| Oracle_linux | — | Upgrade python3-kdcproxyUpgrade ipa-client-encrypted-dnsUpgrade ipa-healthcheck-coreUpgrade ipa-selinux-nfastUpgrade python3-yubicoUpgrade ipa-serverUpgrade ipa-server-dnsUpgrade softhsm-develUpgrade python2-ipaclientUpgrade ipa-healthcheckUpgrade slapi-nisUpgrade ipa-selinuxUpgrade ipa-python-compatUpgrade ipa-clientUpgrade ipa-selinux-lunaUpgrade python2-ipalibUpgrade ipa-server-trust-adUpgrade ipa-client-epnUpgrade python3-custodiaUpgrade python3-ipatestsUpgrade ipa-client-sambaUpgrade softhsmUpgrade python3-qrcode-coreUpgrade ipa-server-commonUpgrade python3-pyusbUpgrade python3-jwcryptoUpgrade ipa-server-encrypted-dnsUpgrade ipa-commonUpgrade python3-ipalibUpgrade python3-ipaclientUpgrade opendnssecUpgrade ipa-client-commonUpgrade custodiaUpgrade bind-dyndb-ldapUpgrade python3-ipaserverUpgrade python3-qrcodeUpgrade python2-ipaserver | Jun 30, 2025 | Jun 17, 2025 |
| Redhat_linux | — | No solution existsUpgrade python3-custodiaUpgrade custodiaUpgrade softhsm-develUpgrade softhsmUpgrade ipa-server-trust-adUpgrade python3-qrcode-coreUpgrade ipa-server-dnsUpgrade bind-dyndb-ldapUpgrade python3-ipalibUpgrade python3-kdcproxyUpgrade opendnssec-debugsourceUpgrade ipa-server-commonUpgrade opendnssecUpgrade ipa-debugsourceUpgrade ipa-healthcheck-coreUpgrade python3-qrcodeUpgrade ipa-debuginfoUpgrade ipa-selinux-nfastUpgrade python2-ipalibUpgrade ipa-server-debuginfoUpgrade ipa-client-commonUpgrade python3-pyusbUpgrade ipa-python-compatUpgrade softhsm-debugsourceUpgrade ipa-client-debuginfoUpgrade ipa-server-encrypted-dnsUpgrade python2-ipaclientUpgrade opendnssec-debuginfoUpgrade slapi-nis-debugsourceUpgrade python3-ipatestsUpgrade ipa-client-sambaUpgrade ipa-selinux-lunaUpgrade python3-ipaclientUpgrade ipa-selinuxUpgrade python2-ipaserverUpgrade softhsm-debuginfoUpgrade ipa-clientUpgrade bind-dyndb-ldap-debuginfoUpgrade slapi-nisUpgrade ipa-server-trust-ad-debuginfoUpgrade ipa-healthcheckUpgrade python3-jwcryptoUpgrade ipa-client-epnUpgrade slapi-nis-debuginfoUpgrade ipa-commonUpgrade bind-dyndb-ldap-debugsourceUpgrade ipa-serverUpgrade ipa-client-encrypted-dnsUpgrade python3-ipaserverUpgrade python3-yubico | Jun 18, 2025 | Jun 17, 2025 |
| Rocky_linux | — | Upgrade slapi-nis-debugsourceUpgrade ipa-server-trust-ad-debuginfoUpgrade ipa-server-trust-adUpgrade opendnssec-debuginfoUpgrade slapi-nisUpgrade opendnssec-debugsourceUpgrade softhsm-debugsourceUpgrade softhsm-debuginfoUpgrade ipa-debugsourceUpgrade ipa-server-debuginfoUpgrade opendnssecUpgrade ipa-serverUpgrade bind-dyndb-ldap-debugsourceUpgrade ipa-clientUpgrade ipa-client-epnUpgrade softhsmUpgrade softhsm-develUpgrade ipa-server-encrypted-dnsUpgrade ipa-client-sambaUpgrade ipa-client-encrypted-dnsUpgrade bind-dyndb-ldap-debuginfoUpgrade slapi-nis-debuginfoUpgrade ipa-client-debuginfoUpgrade ipa-debuginfoUpgrade bind-dyndb-ldap | Jul 31, 2025 | Jul 29, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub