Red Hat Security Advisory

RHSA-2020:0378

ipa security and bug fix update

Released 2020-02-04 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Client (v. 7) ipa-4.6.5-11.el7_7.4, ipa-client-4.6.5-11.el7_7.4, ipa-client-common-4.6.5-11.el7_7.4 +4
Red Hat Enterprise Linux Client Optional (v. 7) ipa-server-4.6.5-11.el7_7.4, ipa-server-common-4.6.5-11.el7_7.4, ipa-server-dns-4.6.5-11.el7_7.4 +2
Red Hat Enterprise Linux ComputeNode (v. 7) ipa-4.6.5-11.el7_7.4, ipa-client-4.6.5-11.el7_7.4, ipa-client-common-4.6.5-11.el7_7.4 +4
Red Hat Enterprise Linux ComputeNode Optional (v. 7) ipa-server-4.6.5-11.el7_7.4, ipa-server-common-4.6.5-11.el7_7.4, ipa-server-dns-4.6.5-11.el7_7.4 +2
Red Hat Enterprise Linux Server (v. 7) ipa-4.6.5-11.el7_7.4, ipa-client-4.6.5-11.el7_7.4, ipa-client-common-4.6.5-11.el7_7.4 +9
Red Hat Enterprise Linux Workstation (v. 7) ipa-4.6.5-11.el7_7.4, ipa-client-4.6.5-11.el7_7.4, ipa-client-common-4.6.5-11.el7_7.4 +9

Fixes 2 records

TI-2019-11071 CVE-2019-14867 · GHSA-7hpj-hfcr-5qwm

Uncontrolled resource consumption in Red Hat ipa

MEDIUM 48

A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way the internal function ber_scanf() was used in some components of the IPA server, w…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.07413 Published 2019-11-27 Partial fix · 4.6.7, 4.7.4 +1 CWE-400

TI-2019-07516 CVE-2019-10195 · GHSA-w4q7-f34x-vpgc

Information disclosure in Red Hat IPA

LOW 32

A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way that FreeIPA's batch processing API logged operations.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01806 Published 2019-11-27 Partial fix · 4.6.7, 4.7.4 +1 CWE-200