Red Hat Security AdvisoryRHSA-2017:0001
ipa security update
Released 2017-01-02 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) ipa-4.4.0-14.el7_3.1.1, ipa-client-4.4.0-14.el7_3.1.1, ipa-client-common-4.4.0-14.el7_3.1.1 +4
- Red Hat Enterprise Linux Client Optional (v. 7) ipa-admintools-4.4.0-14.el7_3.1.1, ipa-server-4.4.0-14.el7_3.1.1, ipa-server-common-4.4.0-14.el7_3.1.1 +3
- Red Hat Enterprise Linux ComputeNode (v. 7) ipa-4.4.0-14.el7_3.1.1, ipa-client-4.4.0-14.el7_3.1.1, ipa-client-common-4.4.0-14.el7_3.1.1 +4
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) ipa-admintools-4.4.0-14.el7_3.1.1, ipa-server-4.4.0-14.el7_3.1.1, ipa-server-common-4.4.0-14.el7_3.1.1 +3
- Red Hat Enterprise Linux Server (v. 7) ipa-4.4.0-14.el7_3.1.1, ipa-admintools-4.4.0-14.el7_3.1.1, ipa-client-4.4.0-14.el7_3.1.1 +10
- Red Hat Enterprise Linux Workstation (v. 7) ipa-4.4.0-14.el7_3.1.1, ipa-admintools-4.4.0-14.el7_3.1.1, ipa-client-4.4.0-14.el7_3.1.1 +10
Fixes 2 records
Priority MEDIUM 40
FreeIPA uses a default password policy that locks an account after 5 unsuccessful authentication attempts, which allows remote attackers to cause a denial of service by locking out the account in which system services ru…
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.04741 · Published 2017-08-28 · Partial fix CWE-255
Priority LOW 29
Ipa versions 4.2.x, 4.3.x before 4.3.3 and 4.4.x before 4.4.3 did not properly check the user's permissions while modifying certificate profiles in IdM's certprofile-mod command.
CVSS 3.0MEDIUM 6.3· Network · Low privileges · No interaction · EPSS 0.00799 · Published 2018-03-13 · Fixed in 4.3.3, 4.4.3 CWE-863
