Vulmon
Amazon Linux 2 Security Advisory: ALAS-2024-2457
Advisory Release Date: 2024-02-15 03:52 Pacific
Advisory Updated Date: 2024-02-19 17:37 Pacific
A Cross-site request forgery vulnerability exists in ipa/session/login_password in all supported versions of IPA. This flaw allows an attacker to trick the user into submitting a request that could perform actions as the user, resulting in a loss of confidentiality and system integrity. During community penetration testing it was found that for certain HTTP end-points FreeIPA does not ensure CSRF protection. Due to implementation details one cannot use this flaw for reflection of a cookie representing already logged-in user. An attacker would always have to go through a new authentication attempt. (CVE-2023-5455)
Affected Packages:
ipa
Note:
This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update ipa to update your system.
aarch64:
ipa-server-4.6.8-5.amzn2.4.3.aarch64
ipa-server-trust-ad-4.6.8-5.amzn2.4.3.aarch64
ipa-client-4.6.8-5.amzn2.4.3.aarch64
ipa-debuginfo-4.6.8-5.amzn2.4.3.aarch64
i686:
ipa-server-4.6.8-5.amzn2.4.3.i686
ipa-server-trust-ad-4.6.8-5.amzn2.4.3.i686
ipa-client-4.6.8-5.amzn2.4.3.i686
ipa-debuginfo-4.6.8-5.amzn2.4.3.i686
noarch:
python2-ipaserver-4.6.8-5.amzn2.4.3.noarch
ipa-server-common-4.6.8-5.amzn2.4.3.noarch
ipa-server-dns-4.6.8-5.amzn2.4.3.noarch
python2-ipaclient-4.6.8-5.amzn2.4.3.noarch
ipa-client-common-4.6.8-5.amzn2.4.3.noarch
ipa-python-compat-4.6.8-5.amzn2.4.3.noarch
python2-ipalib-4.6.8-5.amzn2.4.3.noarch
ipa-common-4.6.8-5.amzn2.4.3.noarch
src:
ipa-4.6.8-5.amzn2.4.3.src
x86_64:
ipa-server-4.6.8-5.amzn2.4.3.x86_64
ipa-server-trust-ad-4.6.8-5.amzn2.4.3.x86_64
ipa-client-4.6.8-5.amzn2.4.3.x86_64
ipa-debuginfo-4.6.8-5.amzn2.4.3.x86_64