A privilege escalation from host to domain vulnerability was found in the FreeIPA project. The FreeIPA package fails to validate the uniqueness of the `krbCanonicalName` for the admin account by default, allowing users to create services with the same canonical name as the REALM admin. When a successful attack happens, the user can retrieve a Kerberos ticket in the name of this service, containing the admin@REALM credential. This flaw allows an attacker to perform administrative tasks over the REALM, leading to access to sensitive data and sensitive data exfiltration.
CVSS Details
- CVSS 3.1 Base Score: 9.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade ipa-server-commonUpgrade python3-kdcproxyUpgrade python3-pyusbUpgrade opendnssecUpgrade python3-qrcodeUpgrade python3-qrcode-coreUpgrade ipa-selinux-nfastUpgrade softhsmUpgrade ipa-server-dnsUpgrade ipa-client-commonUpgrade python3-ipalibUpgrade softhsm-develUpgrade ipa-server-trust-adUpgrade ipa-healthcheck-coreUpgrade slapi-nisUpgrade ipa-server-encrypted-dnsUpgrade ipa-python-compatUpgrade ipa-selinux-lunaUpgrade python3-custodiaUpgrade python3-jwcryptoUpgrade custodiaUpgrade ipa-client-epnUpgrade ipa-commonUpgrade python3-yubicoUpgrade python3-ipaserverUpgrade ipa-client-encrypted-dnsUpgrade python3-ipatestsUpgrade ipa-healthcheckUpgrade ipa-serverUpgrade ipa-client-sambaUpgrade ipa-clientUpgrade bind-dyndb-ldapUpgrade ipa-selinuxUpgrade python3-ipaclient | Jul 1, 2025 | Jun 17, 2025 |
| Amazon Linux Ami 2 | — | Upgrade ipa-server-commonUpgrade python2-ipaserverUpgrade ipa-server-dnsUpgrade python2-ipaclientUpgrade python2-ipalibUpgrade ipa-client-commonUpgrade ipa-debuginfoUpgrade ipa-server-trust-adUpgrade ipa-clientUpgrade ipa-serverUpgrade ipa-python-compatUpgrade ipa-common | Jun 25, 2025 | Jun 17, 2025 |
| Debian | — | Upgrade freeipaNo solution exists | Jun 20, 2025 | Jun 17, 2025 |
| Oracle_linux | — | Upgrade python3-pyusbUpgrade ipa-client-commonUpgrade opendnssecUpgrade python3-ipaserverUpgrade python3-qrcodeUpgrade ipa-client-sambaUpgrade python2-ipaserverUpgrade python3-ipalibUpgrade python3-ipatestsUpgrade python3-qrcode-coreUpgrade custodiaUpgrade ipa-commonUpgrade bind-dyndb-ldapUpgrade softhsmUpgrade python3-jwcryptoUpgrade ipa-server-encrypted-dnsUpgrade python3-ipaclientUpgrade ipa-server-commonUpgrade python3-kdcproxyUpgrade ipa-python-compatUpgrade ipa-client-epnUpgrade ipa-client-encrypted-dnsUpgrade python2-ipalibUpgrade ipa-serverUpgrade ipa-selinux-nfastUpgrade slapi-nisUpgrade ipa-selinuxUpgrade ipa-server-dnsUpgrade ipa-server-trust-adUpgrade ipa-selinux-lunaUpgrade python2-ipaclientUpgrade python3-yubicoUpgrade ipa-healthcheckUpgrade softhsm-develUpgrade ipa-healthcheck-coreUpgrade python3-custodiaUpgrade ipa-client | Jun 30, 2025 | Jun 17, 2025 |
| Redhat_linux | — | Upgrade ipa-debugsourceUpgrade custodiaUpgrade python3-qrcodeUpgrade ipa-python-compatUpgrade python3-pyusbUpgrade ipa-selinux-nfastUpgrade python2-ipaclientUpgrade ipa-server-commonUpgrade bind-dyndb-ldapUpgrade ipa-server-encrypted-dnsUpgrade ipa-client-debuginfoUpgrade softhsm-develUpgrade ipa-server-debuginfoUpgrade ipa-server-dnsUpgrade opendnssec-debugsourceUpgrade ipa-debuginfoUpgrade ipa-client-commonUpgrade ipa-server-trust-adUpgrade softhsmUpgrade python3-custodiaUpgrade ipa-healthcheck-coreUpgrade softhsm-debugsourceNo solution existsUpgrade python3-kdcproxyUpgrade python3-qrcode-coreUpgrade opendnssecUpgrade python3-ipalibUpgrade python2-ipalibUpgrade ipa-serverUpgrade ipa-client-encrypted-dnsUpgrade slapi-nis-debuginfoUpgrade python3-yubicoUpgrade python3-ipatestsUpgrade ipa-commonUpgrade opendnssec-debuginfoUpgrade ipa-healthcheckUpgrade ipa-client-sambaUpgrade ipa-selinux-lunaUpgrade ipa-clientUpgrade bind-dyndb-ldap-debuginfoUpgrade ipa-server-trust-ad-debuginfoUpgrade ipa-selinuxUpgrade slapi-nis-debugsourceUpgrade python2-ipaserverUpgrade softhsm-debuginfoUpgrade python3-jwcryptoUpgrade python3-ipaclientUpgrade python3-ipaserverUpgrade bind-dyndb-ldap-debugsourceUpgrade slapi-nisUpgrade ipa-client-epn | Jun 18, 2025 | Jun 17, 2025 |
| Rocky_linux | — | Upgrade ipa-debugsourceUpgrade opendnssec-debuginfoUpgrade ipa-server-debuginfoUpgrade ipa-server-trust-adUpgrade ipa-server-trust-ad-debuginfoUpgrade slapi-nisUpgrade softhsm-debugsourceUpgrade opendnssec-debugsourceUpgrade softhsm-debuginfoUpgrade slapi-nis-debugsourceUpgrade ipa-server-encrypted-dnsUpgrade opendnssecUpgrade softhsmUpgrade ipa-clientUpgrade bind-dyndb-ldap-debugsourceUpgrade ipa-debuginfoUpgrade ipa-serverUpgrade ipa-client-sambaUpgrade ipa-client-debuginfoUpgrade slapi-nis-debuginfoUpgrade bind-dyndb-ldapUpgrade bind-dyndb-ldap-debuginfoUpgrade ipa-client-epnUpgrade ipa-client-encrypted-dnsUpgrade softhsm-devel | Jul 31, 2025 | Jul 29, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub