Red Hat Security Advisory

RHSA-2024:0145

ipa security update

Released 2024-01-10 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Client (v. 7) ipa-4.6.8-5.el7_9.16, ipa-client-4.6.8-5.el7_9.16, ipa-client-common-4.6.8-5.el7_9.16 +4
Red Hat Enterprise Linux Client Optional (v. 7) ipa-server-4.6.8-5.el7_9.16, ipa-server-common-4.6.8-5.el7_9.16, ipa-server-dns-4.6.8-5.el7_9.16 +2
Red Hat Enterprise Linux ComputeNode Optional (v. 7) ipa-server-4.6.8-5.el7_9.16, ipa-server-common-4.6.8-5.el7_9.16, ipa-server-dns-4.6.8-5.el7_9.16 +2
Red Hat Enterprise Linux Server (v. 7) ipa-4.6.8-5.el7_9.16, ipa-client-4.6.8-5.el7_9.16, ipa-client-common-4.6.8-5.el7_9.16 +9
Red Hat Enterprise Linux Workstation (v. 7) ipa-4.6.8-5.el7_9.16, ipa-client-4.6.8-5.el7_9.16, ipa-client-common-4.6.8-5.el7_9.16 +9

Fixes 1 record

TI-2023-05020 CVE-2023-5455 · GHSA-45hh-rj6v-548f

Ipa: invalid csrf protection

LOW 30

A Cross-site request forgery vulnerability exists in ipa/session/login_password in all supported versions of IPA.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00574 Published 2024-01-10 Partial fix · 4.6.8-5.el7_9.16, 8090020231201152514.3387e3d0 +7 CWE-352