Ipa: invalid csrf protection
Priority LOW 30CWE-352Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Tampering
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Partial Red Hat: 20 fixed, 1 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-352.
Summary
A Cross-site request forgery vulnerability exists in ipa/session/login_password in all supported versions of IPA. This flaw allows an attacker to trick the user into submitting a request that could perform actions as the user, resulting in a loss of confidentiality and system integrity. During community penetration testing it was found that for certain HTTP end-points FreeIPA does not ensure CSRF protection. Due to implementation details one cannot use this flaw for reflection of a cookie representing already logged-in user. An attacker would always have to go through a new authentication attempt.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00574 47th percentileScored 2026-11-07
Fix Partial Red Hat: 9 advisoriesRed Hat: 20 fixed, 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 7 | — | 4.6.8-5.el7_9.16 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | 8090020231201152514.3387e3d0 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.2 Advanced Update Support | — | 8020020231123154806.792f4060 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.2 Telecommunications Update Service | — | 8020020231123154806.792f4060 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions | — | 8020020231123154806.792f4060 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | — | 8040020231123154610.5b01ab7e | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.4 Telecommunications Update Service | — | 8040020231123154610.5b01ab7e | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions | — | 8040020231123154610.5b01ab7e | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support | — | 8060020231208020207.ada582f1 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.8 Extended Update Support | — | 8080020231201153604.b0a6ceea | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | 4.10.2-5.el9_3 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9.0 Extended Update Support | — | 4.9.8-9.el9_0 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9.2 Extended Update Support | — | 4.10.1-10.el9_2 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 6 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | — | Not affected | CNA |
- Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in 4.6.8-5.el7_9.16 Patch available CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 8090020231201152514.3387e3d0 Patch available CNA
- Red Hat Enterprise Linux 8.2 Advanced Update Support VendorRed Hat Affected — Fixed in 8020020231123154806.792f4060 Patch available CNA
- Red Hat Enterprise Linux 8.2 Telecommunications Update Service VendorRed Hat Affected — Fixed in 8020020231123154806.792f4060 Patch available CNA
- Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 8020020231123154806.792f4060 Patch available CNA
- Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support VendorRed Hat Affected — Fixed in 8040020231123154610.5b01ab7e Patch available CNA
- Red Hat Enterprise Linux 8.4 Telecommunications Update Service VendorRed Hat Affected — Fixed in 8040020231123154610.5b01ab7e Patch available CNA
- Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 8040020231123154610.5b01ab7e Patch available CNA
- Red Hat Enterprise Linux 8.6 Extended Update Support VendorRed Hat Affected — Fixed in 8060020231208020207.ada582f1 Patch available CNA
- Red Hat Enterprise Linux 8.8 Extended Update Support VendorRed Hat Affected — Fixed in 8080020231201153604.b0a6ceea Patch available CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 4.10.2-5.el9_3 Patch available CNA
- Red Hat Enterprise Linux 9.0 Extended Update Support VendorRed Hat Affected — Fixed in 4.9.8-9.el9_0 Patch available CNA
- Red Hat Enterprise Linux 9.2 Extended Update Support VendorRed Hat Affected — Fixed in 4.10.1-10.el9_2 Patch available CNA
- Red Hat Enterprise Linux 6 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in — Not affected CNA
CPE configurations NVD · 57
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:freeipa:freeipa:*:*:*:*:*:*:*:* | before 4.6.10; 4.7.0 to before 4.9.14; 4.10.0 to before 4.10.3 | Vulnerable | FreeIPA |
| cpe:2.3:a:freeipa:freeipa:4.11.0:-:*:*:*:*:*:* | 4.11.0 | Vulnerable | FreeIPA |
| cpe:2.3:a:freeipa:freeipa:4.11.0:beta1:*:*:*:*:*:* | 4.11.0 beta1 | Vulnerable | FreeIPA |
| cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* | 38 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* | 39 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:* | 40 | Vulnerable | Fedoraproject |
| cpe:2.3:a:redhat:codeready_linux_builder:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:arm64:* | 8.0 | Vulnerable | Red Hat |
- cpe:2.3:a:freeipa:freeipa:*:*:*:*:*:*:*:* Versions before 4.6.10; 4.7.0 to before 4.9.14; 4.10.0 to before 4.10.3 Vulnerable ·FreeIPA
- cpe:2.3:a:freeipa:freeipa:4.11.0:-:*:*:*:*:*:* Versions 4.11.0 Vulnerable ·FreeIPA
- cpe:2.3:a:freeipa:freeipa:4.11.0:beta1:*:*:*:*:*:* Versions 4.11.0 beta1 Vulnerable ·FreeIPA
- cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* Versions 38 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* Versions 39 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:* Versions 40 Vulnerable ·Fedoraproject
- cpe:2.3:a:redhat:codeready_linux_builder:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:arm64:* Versions 8.0 Vulnerable ·Red Hat
Show 47 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:redhat:enterprise_linux:8.4:*:*:*:*:*:*:* | 8.4 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_eus:8.6:*:*:*:*:*:*:* | 8.6 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_eus:8.6:*:*:*:*:*:arm64:* | 8.6 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_eus:8.8:*:*:*:*:*:*:* | 8.8 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_eus:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_eus:9.2:*:*:*:*:*:*:* | 9.2 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:8.8:*:*:*:*:*:*:* | 8.8 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.2:*:*:*:*:*:*:* | 9.2 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.6:*:*:*:*:*:*:* | 8.6 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.8:*:*:*:*:*:*:* | 8.8 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.2:*:*:*:*:*:*:* | 9.2 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.6:*:*:*:*:*:*:* | 8.6 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.8:*:*:*:*:*:*:* | 8.8 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.2:*:*:*:*:*:*:* | 9.2 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_scientific_computing:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server:9.0:*:*:*:*:*:arm64:* | 9.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server:9.2:*:*:*:*:*:arm64:* | 9.2 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:* | 8.2 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:* | 8.4 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server_aus:8.6:*:*:*:*:*:*:* | 8.6 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server_aus:9.2:*:*:*:*:*:*:* | 9.2 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server_for_ibm_z_systems:9.2:*:*:*:*:*:*:* | 9.2 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.2:*:*:*:*:*:*:* | 8.2 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.4:*:*:*:*:*:*:* | 8.4 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.6:*:*:*:*:*:*:* | 8.6 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:* | 8.2 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:* | 8.4 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server_tus:8.6:*:*:*:*:*:*:* | 8.6 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.2:*:*:*:*:*:*:* | 8.2 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.6:*:*:*:*:*:*:* | 8.6 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:9.2:*:*:*:*:*:*:* | 9.2 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.2:*:*:*:*:*:*:* | 9.2 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
- cpe:2.3:o:redhat:enterprise_linux:8.4:*:*:*:*:*:*:* Versions 8.4 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_eus:8.6:*:*:*:*:*:*:* Versions 8.6 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_eus:8.6:*:*:*:*:*:arm64:* Versions 8.6 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_eus:8.8:*:*:*:*:*:*:* Versions 8.8 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_eus:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_eus:9.2:*:*:*:*:*:*:* Versions 9.2 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:8.8:*:*:*:*:*:*:* Versions 8.8 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.2:*:*:*:*:*:*:* Versions 9.2 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.6:*:*:*:*:*:*:* Versions 8.6 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.8:*:*:*:*:*:*:* Versions 8.8 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.2:*:*:*:*:*:*:* Versions 9.2 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.6:*:*:*:*:*:*:* Versions 8.6 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.8:*:*:*:*:*:*:* Versions 8.8 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.2:*:*:*:*:*:*:* Versions 9.2 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_scientific_computing:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server:9.0:*:*:*:*:*:arm64:* Versions 9.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server:9.2:*:*:*:*:*:arm64:* Versions 9.2 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:* Versions 8.2 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:* Versions 8.4 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server_aus:8.6:*:*:*:*:*:*:* Versions 8.6 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server_aus:9.2:*:*:*:*:*:*:* Versions 9.2 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server_for_ibm_z_systems:9.2:*:*:*:*:*:*:* Versions 9.2 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.2:*:*:*:*:*:*:* Versions 8.2 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.4:*:*:*:*:*:*:* Versions 8.4 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.6:*:*:*:*:*:*:* Versions 8.6 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:* Versions 8.2 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:* Versions 8.4 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server_tus:8.6:*:*:*:*:*:*:* Versions 8.6 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.2:*:*:*:*:*:*:* Versions 8.2 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.6:*:*:*:*:*:*:* Versions 8.6 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:9.2:*:*:*:*:*:*:* Versions 9.2 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.2:*:*:*:*:*:*:* Versions 9.2 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
Remediation
Red Hat 9 advisories
- RHSA-2024:0140 Released 2024-01-10 · Red Hat rating Moderateipa security update
- Red Hat CodeReady Linux Builder EUS (v.9.0) python3-ipatests-4.9.8-9.el9_0
- Red Hat Enterprise Linux AppStream EUS (v.9.0) ipa-4.9.8-9.el9_0, ipa-client-4.9.8-9.el9_0, ipa-client-common-4.9.8-9.el9_0 +11
- RHSA-2024:0143 Released 2024-01-10 · Red Hat rating Moderateidm:DL1 security update
- Red Hat Enterprise Linux AppStream (v. 8) bind-dyndb-ldap-11.6-4.module+el8.9.0+18911+94941f82.aarch64::idm:DL1, bind-dyndb-ldap-11.6-4.module+el8.9.0+18911+94941f82.ppc64le::idm:DL1, bind-dyndb-ldap-11.6-4.module+el8.9.0+18911+94941f82.s390x::idm:DL1 +47
- RHSA-2024:0142 Released 2024-01-10 · Red Hat rating Moderateipa security update
- Red Hat CodeReady Linux Builder EUS (v.9.2) python3-ipatests-4.10.1-10.el9_2
- Red Hat Enterprise Linux AppStream EUS (v.9.2) ipa-4.10.1-10.el9_2, ipa-client-4.10.1-10.el9_2, ipa-client-common-4.10.1-10.el9_2 +11
Show 6 more Red Hat advisories
- RHSA-2024:0145 Released 2024-01-10 · Red Hat rating Moderateipa security update
- Red Hat Enterprise Linux Client (v. 7) ipa-4.6.8-5.el7_9.16, ipa-client-4.6.8-5.el7_9.16, ipa-client-common-4.6.8-5.el7_9.16 +4
- Red Hat Enterprise Linux Client Optional (v. 7) ipa-server-4.6.8-5.el7_9.16, ipa-server-common-4.6.8-5.el7_9.16, ipa-server-dns-4.6.8-5.el7_9.16 +2
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) ipa-server-4.6.8-5.el7_9.16, ipa-server-common-4.6.8-5.el7_9.16, ipa-server-dns-4.6.8-5.el7_9.16 +2
- Red Hat Enterprise Linux Server (v. 7) ipa-4.6.8-5.el7_9.16, ipa-client-4.6.8-5.el7_9.16, ipa-client-common-4.6.8-5.el7_9.16 +9
- Red Hat Enterprise Linux Workstation (v. 7) ipa-4.6.8-5.el7_9.16, ipa-client-4.6.8-5.el7_9.16, ipa-client-common-4.6.8-5.el7_9.16 +9
- RHSA-2024:0141 Released 2024-01-10 · Red Hat rating Moderateipa security update
- Red Hat CodeReady Linux Builder (v. 9) python3-ipatests-4.10.2-5.el9_3
- Red Hat Enterprise Linux AppStream (v. 9) ipa-4.10.2-5.el9_3, ipa-client-4.10.2-5.el9_3, ipa-client-common-4.10.2-5.el9_3 +11
- RHSA-2024:0144 Released 2024-01-10 · Red Hat rating Moderateidm:DL1 security update
- Red Hat Enterprise Linux AppStream AUS (v. 8.2) bind-dyndb-ldap-11.2-3.module+el8.2.0+4921+923e30d5.src::idm:DL1, bind-dyndb-ldap-11.2-3.module+el8.2.0+4921+923e30d5.x86_64::idm:DL1, custodia-0.6.0-3.module+el8.1.0+4098+f286395e.noarch::idm:DL1 +38
- Red Hat Enterprise Linux AppStream E4S (v. 8.2) bind-dyndb-ldap-11.2-3.module+el8.2.0+4921+923e30d5.ppc64le::idm:DL1, bind-dyndb-ldap-11.2-3.module+el8.2.0+4921+923e30d5.src::idm:DL1, bind-dyndb-ldap-11.2-3.module+el8.2.0+4921+923e30d5.x86_64::idm:DL1 +47
- Red Hat Enterprise Linux AppStream TUS (v. 8.2) bind-dyndb-ldap-11.2-3.module+el8.2.0+4921+923e30d5.src::idm:DL1, bind-dyndb-ldap-11.2-3.module+el8.2.0+4921+923e30d5.x86_64::idm:DL1, custodia-0.6.0-3.module+el8.1.0+4098+f286395e.noarch::idm:DL1 +38
- RHSA-2024:0139 Released 2024-01-10 · Red Hat rating Moderateidm:DL1 security update
- Red Hat Enterprise Linux AppStream EUS (v.8.6) bind-dyndb-ldap-11.6-4.module+el8.6.0+16878+6c033536.aarch64::idm:DL1, bind-dyndb-ldap-11.6-4.module+el8.6.0+16878+6c033536.ppc64le::idm:DL1, bind-dyndb-ldap-11.6-4.module+el8.6.0+16878+6c033536.s390x::idm:DL1 +47
- RHSA-2024:0137 Released 2024-01-10 · Red Hat rating Moderateidm:DL1 security update
- Red Hat Enterprise Linux AppStream EUS (v.8.8) bind-dyndb-ldap-11.6-4.module+el8.8.0+17351+9a3fb056.aarch64::idm:DL1, bind-dyndb-ldap-11.6-4.module+el8.8.0+17351+9a3fb056.ppc64le::idm:DL1, bind-dyndb-ldap-11.6-4.module+el8.8.0+17351+9a3fb056.s390x::idm:DL1 +47
- RHSA-2024:0138 Released 2024-01-10 · Red Hat rating Moderateidm:DL1 security update
- Red Hat Enterprise Linux AppStream AUS (v.8.4) bind-dyndb-ldap-11.6-2.module+el8.4.0+9328+4ec4e316.src::idm:DL1, bind-dyndb-ldap-11.6-2.module+el8.4.0+9328+4ec4e316.x86_64::idm:DL1, custodia-0.6.0-3.module+el8.1.0+4098+f286395e.noarch::idm:DL1 +39
- Red Hat Enterprise Linux AppStream E4S (v.8.4) bind-dyndb-ldap-11.6-2.module+el8.4.0+9328+4ec4e316.aarch64::idm:DL1, bind-dyndb-ldap-11.6-2.module+el8.4.0+9328+4ec4e316.ppc64le::idm:DL1, bind-dyndb-ldap-11.6-2.module+el8.4.0+9328+4ec4e316.s390x::idm:DL1 +47
- Red Hat Enterprise Linux AppStream TUS (v.8.4) bind-dyndb-ldap-11.6-2.module+el8.4.0+9328+4ec4e316.src::idm:DL1, bind-dyndb-ldap-11.6-2.module+el8.4.0+9328+4ec4e316.x86_64::idm:DL1, custodia-0.6.0-3.module+el8.1.0+4098+f286395e.noarch::idm:DL1 +39
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat CodeReady Linux Builder (v. 9) | Fixed | RHSA-2024:0141 |
| Red Hat CodeReady Linux Builder EUS (v.9.0) | Fixed | RHSA-2024:0140 |
| Red Hat CodeReady Linux Builder EUS (v.9.2) | Fixed | RHSA-2024:0142 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2024:0143 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2024:0141 |
| Red Hat Enterprise Linux AppStream AUS (v. 8.2) | Fixed | RHSA-2024:0144 |
| Red Hat Enterprise Linux AppStream AUS (v.8.4) | Fixed | RHSA-2024:0138 |
| Red Hat Enterprise Linux AppStream E4S (v. 8.2) | Fixed | RHSA-2024:0144 |
| Red Hat Enterprise Linux AppStream E4S (v.8.4) | Fixed | RHSA-2024:0138 |
| Red Hat Enterprise Linux AppStream EUS (v.8.6) | Fixed | RHSA-2024:0139 |
| Red Hat Enterprise Linux AppStream EUS (v.8.8) | Fixed | RHSA-2024:0137 |
| Red Hat Enterprise Linux AppStream EUS (v.9.0) | Fixed | RHSA-2024:0140 |
| Red Hat Enterprise Linux AppStream EUS (v.9.2) | Fixed | RHSA-2024:0142 |
| Red Hat Enterprise Linux AppStream TUS (v. 8.2) | Fixed | RHSA-2024:0144 |
| Red Hat Enterprise Linux AppStream TUS (v.8.4) | Fixed | RHSA-2024:0138 |
| Red Hat Enterprise Linux Client (v. 7) | Fixed | RHSA-2024:0145 |
| Red Hat Enterprise Linux Client Optional (v. 7) | Fixed | RHSA-2024:0145 |
| Red Hat Enterprise Linux ComputeNode Optional (v. 7) | Fixed | RHSA-2024:0145 |
| Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2024:0145 |
| Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2024:0145 |
Not affected: 1 product
- Red Hat Enterprise Linux 8
Timeline
- 2026-10-02 Threatist record created from CVE-2023-5455
- 2026-10-03 Alias added: GHSA-45hh-rj6v-548f
References
Advisory 12
More Red Hat Codeready Linux Builder vulnerabilities
- TI-2019-06284 Memory corruption in webkitgtk KEVCVSS 3.1HIGH 8.8
- TI-2023-04522 Glibc: buffer overflow in ld.so leading to privilege escalation KEVCVSS 3.1HIGH 7.8
- TI-2022-00753 A flaw was found in the way the "flags" member of the new pipe buffer structure was… KEVCVSS 3.1HIGH 7.8
- TI-2022-00413 Improper authentication in kernel KEVCVSS 3.1HIGH 7.8
- TI-2021-19843 Out-of-bounds read in Samba CVSS 3.1HIGH 8.8
- TI-2022-00359 Out-of-bounds write in kernel CVSS 3.1HIGH 8.8
Sources
- CVE-2023-5455 · CVE Program
- CVE-2023-5455 · NVD
- FIRST EPSS
- GHSA-45hh-rj6v-548f · GitHub Advisory Database · CC BY 4.0
- CVE-2023-5455 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences