The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
A privilege escalation from host to domain vulnerability was found in the FreeIPA project. The FreeIPA package fails to validate the uniqueness of the `krbCanonicalName` for the admin account by default, allowing users to create services with the same canonical name as the REALM admin. When a successful attack happens, the user can retrieve a Kerberos ticket in the name of this service, containing the admin@REALM credential. This flaw allows an attacker to perform administrative tasks over the REALM, leading to access to sensitive data and sensitive data exfiltration.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python3-ipaserverUpgrade ipa-clientUpgrade custodiaUpgrade python3-jwcryptoUpgrade ipa-client-encrypted-dnsUpgrade python3-ipaclientUpgrade ipa-commonUpgrade python3-ipatestsUpgrade ipa-client-sambaUpgrade python3-yubicoUpgrade ipa-client-epnUpgrade ipa-selinuxUpgrade ipa-healthcheckUpgrade ipa-serverUpgrade bind-dyndb-ldapUpgrade python3-qrcode-coreUpgrade ipa-client-commonUpgrade python3-custodiaUpgrade ipa-healthcheck-coreUpgrade ipa-selinux-lunaUpgrade ipa-python-compatUpgrade ipa-server-dnsUpgrade ipa-server-trust-adUpgrade ipa-selinux-nfastUpgrade softhsm-develUpgrade python3-ipalibUpgrade opendnssecUpgrade slapi-nisUpgrade ipa-server-encrypted-dnsUpgrade ipa-server-commonUpgrade python3-qrcodeUpgrade python3-pyusbUpgrade python3-kdcproxyUpgrade softhsm | Jul 1, 2025 | Jun 17, 2025 |
| Amazon Linux Ami 2 | — | Upgrade ipa-server-trust-adUpgrade ipa-debuginfoUpgrade python2-ipalibUpgrade ipa-client-commonUpgrade ipa-serverUpgrade ipa-clientUpgrade ipa-python-compatUpgrade ipa-commonUpgrade python2-ipaclientUpgrade ipa-server-dnsUpgrade python2-ipaserverUpgrade ipa-server-common | Jun 25, 2025 | Jun 17, 2025 |
| Debian | — | Upgrade freeipa | Jun 20, 2025 | Jun 17, 2025 |
| Oracle_linux | — | Upgrade python3-jwcryptoUpgrade python3-qrcode-coreUpgrade python3-ipalibUpgrade python3-ipaclientUpgrade python2-ipaserverUpgrade softhsmUpgrade python3-ipatestsUpgrade bind-dyndb-ldapUpgrade ipa-client-commonUpgrade ipa-server-commonUpgrade ipa-client-sambaUpgrade python3-ipaserverUpgrade python3-pyusbUpgrade python3-qrcodeUpgrade ipa-commonUpgrade ipa-server-encrypted-dnsUpgrade opendnssecUpgrade custodiaUpgrade ipa-clientUpgrade softhsm-develUpgrade ipa-python-compatUpgrade python2-ipalibUpgrade ipa-healthcheckUpgrade ipa-serverUpgrade ipa-selinuxUpgrade slapi-nisUpgrade ipa-client-encrypted-dnsUpgrade ipa-selinux-nfastUpgrade python3-kdcproxyUpgrade ipa-client-epnUpgrade python3-yubicoUpgrade ipa-healthcheck-coreUpgrade ipa-selinux-lunaUpgrade python2-ipaclientUpgrade ipa-server-trust-adUpgrade ipa-server-dnsUpgrade python3-custodia | Jun 30, 2025 | Jun 17, 2025 |
| Redhat_linux | — | Upgrade ipa-server-encrypted-dnsNo solution existsUpgrade python3-qrcode-coreUpgrade ipa-server-trust-adUpgrade softhsm-debugsourceUpgrade ipa-client-debuginfoUpgrade python2-ipaclientUpgrade ipa-debuginfoUpgrade ipa-server-dnsUpgrade ipa-debugsourceUpgrade python3-ipalibUpgrade custodiaUpgrade ipa-healthcheck-coreUpgrade ipa-client-commonUpgrade opendnssecUpgrade python3-qrcodeUpgrade python3-kdcproxyUpgrade python2-ipalibUpgrade opendnssec-debugsourceUpgrade ipa-python-compatUpgrade python3-pyusbUpgrade python3-custodiaUpgrade softhsm-develUpgrade ipa-server-debuginfoUpgrade ipa-selinux-nfastUpgrade bind-dyndb-ldapUpgrade ipa-server-commonUpgrade softhsmUpgrade python2-ipaserverUpgrade slapi-nis-debugsourceUpgrade softhsm-debuginfoUpgrade bind-dyndb-ldap-debugsourceUpgrade ipa-clientUpgrade bind-dyndb-ldap-debuginfoUpgrade ipa-selinuxUpgrade ipa-selinux-lunaUpgrade python3-ipatestsUpgrade ipa-commonUpgrade python3-ipaserverUpgrade ipa-server-trust-ad-debuginfoUpgrade slapi-nisUpgrade ipa-client-sambaUpgrade opendnssec-debuginfoUpgrade ipa-healthcheckUpgrade slapi-nis-debuginfoUpgrade python3-ipaclientUpgrade python3-yubicoUpgrade ipa-client-epnUpgrade ipa-serverUpgrade ipa-client-encrypted-dnsUpgrade python3-jwcrypto | Jun 18, 2025 | Jun 17, 2025 |
| Rocky_linux | — | Upgrade bind-dyndb-ldap-debuginfoUpgrade opendnssecUpgrade softhsm-develUpgrade slapi-nis-debuginfoUpgrade ipa-debuginfoUpgrade ipa-client-encrypted-dnsUpgrade ipa-client-epnUpgrade ipa-server-encrypted-dnsUpgrade bind-dyndb-ldapUpgrade ipa-client-sambaUpgrade ipa-serverUpgrade ipa-client-debuginfoUpgrade ipa-clientUpgrade softhsmUpgrade bind-dyndb-ldap-debugsourceUpgrade softhsm-debuginfoUpgrade slapi-nisUpgrade opendnssec-debugsourceUpgrade ipa-server-trust-adUpgrade opendnssec-debuginfoUpgrade ipa-server-trust-ad-debuginfoUpgrade ipa-server-debuginfoUpgrade ipa-debugsourceUpgrade softhsm-debugsourceUpgrade slapi-nis-debugsource | Jul 31, 2025 | Jul 29, 2025 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub