Vulmon Recent Vulnerabilities Product List Research Posts Trends Blog About Contact

freeipa freeipa vulnerabilities and exploits

(subscribe to this query)
8.1
CVSSv3

CVE-2024-3183

A vulnerability was found in FreeIPA in a way when a Kerberos TGS-REQ is encrypted using the client’s session key. This key is different for each new session, which protects it from brute force attacks. However, the ticket it contains is encrypted using the target principal...
Redhat Enterprise Linux 7.0Redhat Enterprise Linux 8.0Redhat Enterprise Linux Aus 8.2Redhat Enterprise Linux Aus 8.4Redhat Enterprise Linux Aus 8.6Redhat Enterprise Linux Eus 8.8Redhat Enterprise Linux Tus 8.4Redhat Enterprise Linux Tus 8.6Redhat Enterprise Linux Update Services For Sap Solutions 8.4Redhat Enterprise Linux Update Services For Sap Solutions 8.6
8.8
CVSSv3

CVE-2024-2698

A vulnerability was found in FreeIPA in how the initial implementation of MS-SFU by MIT Kerberos was missing a condition for granting the "forwardable" flag on S4U2Self tickets. Fixing this mistake required adding a special case for the check_allowed_to_delegate() funct...
Freeipa FreeipaFreeipa Freeipa 4.12.0
5.3
CVSSv3

CVE-2024-1481

A flaw was found in FreeIPA. This issue may allow a remote malicious user to craft a HTTP request with parameters that can be interpreted as command arguments to kinit on the FreeIPA server, which can lead to a denial of service.
6.5
CVSSv3

CVE-2023-5455

A Cross-site request forgery vulnerability exists in ipa/session/login_password in all supported versions of IPA. This flaw allows an malicious user to trick the user into submitting a request that could perform actions as the user, resulting in a loss of confidentiality and syst...
Freeipa FreeipaFreeipa Freeipa 4.11.0Fedoraproject Fedora 38Fedoraproject Fedora 39Fedoraproject Fedora 40Redhat Codeready Linux Builder -Redhat Enterprise Linux 7.0Redhat Enterprise Linux 8.0Redhat Enterprise Linux 8.4Redhat Enterprise Linux 9.0Redhat Enterprise Linux Desktop 7.0Redhat Enterprise Linux Eus 8.6
8.8
CVSSv3

CVE-2022-4254

sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters
Fedoraproject SssdRedhat Enterprise Linux 8.0Redhat Enterprise Linux Desktop 7.0Redhat Enterprise Linux For Ibm Z Systems 7.0Redhat Enterprise Linux For Power Big Endian 7.0Redhat Enterprise Linux For Power Little Endian 7.0Redhat Enterprise Linux For Scientific Computing 7.0Redhat Enterprise Linux Server 7.0Redhat Enterprise Linux Server Aus 8.2Redhat Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions 8.1Redhat Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions 8.2Redhat Enterprise Linux Server Tus 8.2
8.8
CVSSv3

CVE-2021-3621

A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cache-expire subcommands. This flaw allows an malicious user to trick the root user into running a specially crafted sssctl command, such as via sudo, to gain root ...
Fedoraproject Sssd 2.6.0Redhat Virtualization 4.0Redhat Virtualization Host 4.0Redhat Enterprise Linux 6.0Redhat Enterprise Linux 7.0Redhat Enterprise Linux 8.0Redhat Enterprise Linux Eus 8.1Redhat Enterprise Linux Eus 8.2Redhat Enterprise Linux Server Aus 8.2Redhat Enterprise Linux Server Aus 8.4Redhat Enterprise Linux Server Tus 8.2Redhat Enterprise Linux Server Tus 8.4
5.9
CVSSv3

CVE-2021-3494

A smart proxy that provides a restful API to various sub-systems of the Foreman is affected by the flaw which can cause a Man-in-the-Middle attack. The FreeIPA module of Foreman smart proxy does not check the SSL certificate, thus, an unauthenticated attacker can perform actions ...
Theforeman Foreman
5.3
CVSSv3

CVE-2020-1722

A flaw was found in all ipa versions 4.x.x up to and including 4.8.0. When sending a very long password (>= 1,000,000 characters) to the server, the password hashing process could exhaust memory and CPU leading to a denial of service and the website becoming unresponsive. The ...
Freeipa FreeipaRedhat Enterprise Linux 6.0Redhat Enterprise Linux 7.0Redhat Enterprise Linux 8.0
8.8
CVSSv3

CVE-2019-14867

A flaw was found in IPA, all 4.6.x versions prior to 4.6.7, all 4.7.x versions prior to 4.7.4 and all 4.8.x versions prior to 4.8.3, in the way the internal function ber_scanf() was used in some components of the IPA server, which parsed kerberos key data. An unauthenticated atta...
Freeipa FreeipaFedoraproject Fedora 30Fedoraproject Fedora 31
6.5
CVSSv3

CVE-2019-10195

A flaw was found in IPA, all 4.6.x versions prior to 4.6.7, all 4.7.x versions prior to 4.7.4 and all 4.8.x versions prior to 4.8.3, in the way that FreeIPA's batch processing API logged operations. This included passing user passwords in clear text on FreeIPA masters. Batch...
Freeipa FreeipaFedoraproject Fedora 30Fedoraproject Fedora 31
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
log injectionCVE-2024-42327CVE-2024-53691cameraCVE-2024-53810CVE-2024-41649logic flawCVE-2024-38921CVE-2024-41713
Home
/
Search Results
Vulmon Logo Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Product List Vendor List Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook