A privilege escalation from host to domain vulnerability was found in the FreeIPA project. The FreeIPA package fails to validate the uniqueness of the `krbCanonicalName` for the admin account by default, allowing users to create services with the same canonical name as the REALM admin. When a successful attack happens, the user can retrieve a Kerberos ticket in the name of this service, containing the admin@REALM credential. This flaw allows an attacker to perform administrative tasks over the REALM, leading to access to sensitive data and sensitive data exfiltration.
CVSS Details
- CVSS 3.1 Base Score: 9.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | alma-upgrade-bind-dyndb-ldapalma-upgrade-custodiaalma-upgrade-ipa-clientalma-upgrade-ipa-client-commonalma-upgrade-ipa-client-encrypted-dnsalma-upgrade-ipa-client-epnalma-upgrade-ipa-client-sambaalma-upgrade-ipa-commonalma-upgrade-ipa-healthcheckalma-upgrade-ipa-healthcheck-corealma-upgrade-ipa-python-compatalma-upgrade-ipa-selinuxalma-upgrade-ipa-selinux-lunaalma-upgrade-ipa-selinux-nfastalma-upgrade-ipa-serveralma-upgrade-ipa-server-commonalma-upgrade-ipa-server-dnsalma-upgrade-ipa-server-encrypted-dnsalma-upgrade-ipa-server-trust-adalma-upgrade-opendnssecalma-upgrade-python3-custodiaalma-upgrade-python3-ipaclientalma-upgrade-python3-ipalibalma-upgrade-python3-ipaserveralma-upgrade-python3-ipatestsalma-upgrade-python3-jwcryptoalma-upgrade-python3-kdcproxyalma-upgrade-python3-pyusbalma-upgrade-python3-qrcodealma-upgrade-python3-qrcode-corealma-upgrade-python3-yubicoalma-upgrade-slapi-nisalma-upgrade-softhsmalma-upgrade-softhsm-devel | Jul 1, 2025 | Jun 17, 2025 | |
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-ipa-clientamazon-linux-ami-2-upgrade-ipa-client-commonamazon-linux-ami-2-upgrade-ipa-commonamazon-linux-ami-2-upgrade-ipa-debuginfoamazon-linux-ami-2-upgrade-ipa-python-compatamazon-linux-ami-2-upgrade-ipa-serveramazon-linux-ami-2-upgrade-ipa-server-commonamazon-linux-ami-2-upgrade-ipa-server-dnsamazon-linux-ami-2-upgrade-ipa-server-trust-adamazon-linux-ami-2-upgrade-python2-ipaclientamazon-linux-ami-2-upgrade-python2-ipalibamazon-linux-ami-2-upgrade-python2-ipaserver | Jun 25, 2025 | Jun 17, 2025 | |
| Debian | no-fix-debian-deb-package | Jun 20, 2025 | Jun 17, 2025 | |
| Oracle_linux | — | oracle-linux-upgrade-bind-dyndb-ldaporacle-linux-upgrade-custodiaoracle-linux-upgrade-ipa-clientoracle-linux-upgrade-ipa-client-commonoracle-linux-upgrade-ipa-client-encrypted-dnsoracle-linux-upgrade-ipa-client-epnoracle-linux-upgrade-ipa-client-sambaoracle-linux-upgrade-ipa-commonoracle-linux-upgrade-ipa-healthcheckoracle-linux-upgrade-ipa-healthcheck-coreoracle-linux-upgrade-ipa-python-compatoracle-linux-upgrade-ipa-selinuxoracle-linux-upgrade-ipa-selinux-lunaoracle-linux-upgrade-ipa-selinux-nfastoracle-linux-upgrade-ipa-serveroracle-linux-upgrade-ipa-server-commonoracle-linux-upgrade-ipa-server-dnsoracle-linux-upgrade-ipa-server-encrypted-dnsoracle-linux-upgrade-ipa-server-trust-adoracle-linux-upgrade-opendnssecoracle-linux-upgrade-python2-ipaclientoracle-linux-upgrade-python2-ipaliboracle-linux-upgrade-python2-ipaserveroracle-linux-upgrade-python3-custodiaoracle-linux-upgrade-python3-ipaclientoracle-linux-upgrade-python3-ipaliboracle-linux-upgrade-python3-ipaserveroracle-linux-upgrade-python3-ipatestsoracle-linux-upgrade-python3-jwcryptooracle-linux-upgrade-python3-kdcproxyoracle-linux-upgrade-python3-pyusboracle-linux-upgrade-python3-qrcodeoracle-linux-upgrade-python3-qrcode-coreoracle-linux-upgrade-python3-yubicooracle-linux-upgrade-slapi-nisoracle-linux-upgrade-softhsmoracle-linux-upgrade-softhsm-devel | Jun 30, 2025 | Jun 17, 2025 |
| Redhat_linux | redhat-upgrade-bind-dyndb-ldapredhat-upgrade-bind-dyndb-ldap-debuginforedhat-upgrade-bind-dyndb-ldap-debugsourceredhat-upgrade-custodiaredhat-upgrade-ipa-clientredhat-upgrade-ipa-client-commonredhat-upgrade-ipa-client-debuginforedhat-upgrade-ipa-client-encrypted-dnsredhat-upgrade-ipa-client-epnredhat-upgrade-ipa-client-sambaredhat-upgrade-ipa-commonredhat-upgrade-ipa-debuginforedhat-upgrade-ipa-debugsourceredhat-upgrade-ipa-healthcheckredhat-upgrade-ipa-healthcheck-coreredhat-upgrade-ipa-python-compatredhat-upgrade-ipa-selinuxredhat-upgrade-ipa-selinux-lunaredhat-upgrade-ipa-selinux-nfastredhat-upgrade-ipa-serverredhat-upgrade-ipa-server-commonredhat-upgrade-ipa-server-debuginforedhat-upgrade-ipa-server-dnsredhat-upgrade-ipa-server-encrypted-dnsredhat-upgrade-ipa-server-trust-adredhat-upgrade-ipa-server-trust-ad-debuginforedhat-upgrade-opendnssecredhat-upgrade-opendnssec-debuginforedhat-upgrade-opendnssec-debugsourceredhat-upgrade-python2-ipaclientredhat-upgrade-python2-ipalibredhat-upgrade-python2-ipaserverredhat-upgrade-python3-custodiaredhat-upgrade-python3-ipaclientredhat-upgrade-python3-ipalibredhat-upgrade-python3-ipaserverredhat-upgrade-python3-ipatestsredhat-upgrade-python3-jwcryptoredhat-upgrade-python3-kdcproxyredhat-upgrade-python3-pyusbredhat-upgrade-python3-qrcoderedhat-upgrade-python3-qrcode-coreredhat-upgrade-python3-yubicoredhat-upgrade-slapi-nisredhat-upgrade-slapi-nis-debuginforedhat-upgrade-slapi-nis-debugsourceredhat-upgrade-softhsmredhat-upgrade-softhsm-debuginforedhat-upgrade-softhsm-debugsourceredhat-upgrade-softhsm-devel | Jun 18, 2025 | Jun 17, 2025 | |
| Rocky_linux | rocky-upgrade-bind-dyndb-ldaprocky-upgrade-bind-dyndb-ldap-debuginforocky-upgrade-bind-dyndb-ldap-debugsourcerocky-upgrade-ipa-clientrocky-upgrade-ipa-client-debuginforocky-upgrade-ipa-client-encrypted-dnsrocky-upgrade-ipa-client-epnrocky-upgrade-ipa-client-sambarocky-upgrade-ipa-debuginforocky-upgrade-ipa-debugsourcerocky-upgrade-ipa-serverrocky-upgrade-ipa-server-debuginforocky-upgrade-ipa-server-encrypted-dnsrocky-upgrade-ipa-server-trust-adrocky-upgrade-ipa-server-trust-ad-debuginforocky-upgrade-opendnssecrocky-upgrade-opendnssec-debuginforocky-upgrade-opendnssec-debugsourcerocky-upgrade-slapi-nisrocky-upgrade-slapi-nis-debuginforocky-upgrade-slapi-nis-debugsourcerocky-upgrade-softhsmrocky-upgrade-softhsm-debuginforocky-upgrade-softhsm-debugsourcerocky-upgrade-softhsm-devel | Jul 31, 2025 | Jul 29, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub