Read the docs
TI-2024-02983 Aliases CVE-2024-3183GHSA-8g25-xmmm-86qm

Freeipa: user can obtain a hash of the passwords of all domain users and perform offline brute force

Priority MEDIUM 41CWE-916Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

A vulnerability was found in FreeIPA in a way when a Kerberos TGS-REQ is encrypted using the client’s session key. This key is different for each new session, which protects it from brute force attacks. However, the ticket it contains is encrypted using the target principal key directly. For user principals, this key is a hash of a public per-principal randomly-generated salt and the user’s password. If a principal is compromised it means the attacker would be able to retrieve tickets encrypted to any principal, all of them being encrypted by their own key directly. By taking these tickets and salts offline, the attacker could run brute force attacks to find character strings able to decrypt tickets when combined to a principal salt (i.e. find the principal’s password).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02053 81st percentileScored 2026-11-07
Fix Fixed freeipa: 4.12.1Red Hat: 9 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—freeipa—4.12.1Patch availableCNA
Red HatRed Hat Enterprise Linux 7—4.6.8-5.el7_9.17Patch availableCNA
Red HatRed Hat Enterprise Linux 8—8100020240528133707.823393f5Patch availableCNA
Red HatRed Hat Enterprise Linux 8.2 Advanced Update Support—8020020240530191103.792f4060Patch availableCNA
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support—8040020240528055121.5b01ab7ePatch availableCNA
Red HatRed Hat Enterprise Linux 8.4 Telecommunications Update Service—8040020240528055121.5b01ab7ePatch availableCNA
Red HatRed Hat Enterprise Linux 8.4 Update Services for SAP Solutions—8040020240528055121.5b01ab7ePatch availableCNA
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support—8060020240530061719.ada582f1Patch availableCNA
Red HatRed Hat Enterprise Linux 8.6 Telecommunications Update Service—8060020240530061719.ada582f1Patch availableCNA
Red HatRed Hat Enterprise Linux 8.6 Update Services for SAP Solutions—8060020240530061719.ada582f1Patch availableCNA
Red HatRed Hat Enterprise Linux 8.8 Extended Update Support—8080020240530051744.b0a6ceeaPatch availableCNA
Red HatRed Hat Enterprise Linux 9—4.11.0-15.el9_4Patch availableCNA
Red HatRed Hat Enterprise Linux 9.0 Extended Update Support—4.9.8-11.el9_0.3Patch availableCNA
Red HatRed Hat Enterprise Linux 9.2 Extended Update Support—4.10.1-12.el9_2.2Patch availableCNA
Red HatRed Hat Enterprise Linux 10——Not affectedCNA
  • freeipa Vendor— Affected — Fixed in 4.12.1 Patch available CNA
  • Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in 4.6.8-5.el7_9.17 Patch available CNA
  • Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 8100020240528133707.823393f5 Patch available CNA
  • Red Hat Enterprise Linux 8.2 Advanced Update Support VendorRed Hat Affected — Fixed in 8020020240530191103.792f4060 Patch available CNA
  • Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support VendorRed Hat Affected — Fixed in 8040020240528055121.5b01ab7e Patch available CNA
  • Red Hat Enterprise Linux 8.4 Telecommunications Update Service VendorRed Hat Affected — Fixed in 8040020240528055121.5b01ab7e Patch available CNA
  • Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 8040020240528055121.5b01ab7e Patch available CNA
  • Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support VendorRed Hat Affected — Fixed in 8060020240530061719.ada582f1 Patch available CNA
  • Red Hat Enterprise Linux 8.6 Telecommunications Update Service VendorRed Hat Affected — Fixed in 8060020240530061719.ada582f1 Patch available CNA
  • Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 8060020240530061719.ada582f1 Patch available CNA
  • Red Hat Enterprise Linux 8.8 Extended Update Support VendorRed Hat Affected — Fixed in 8080020240530051744.b0a6ceea Patch available CNA
  • Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 4.11.0-15.el9_4 Patch available CNA
  • Red Hat Enterprise Linux 9.0 Extended Update Support VendorRed Hat Affected — Fixed in 4.9.8-11.el9_0.3 Patch available CNA
  • Red Hat Enterprise Linux 9.2 Extended Update Support VendorRed Hat Affected — Fixed in 4.10.1-12.el9_2.2 Patch available CNA
  • Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in — Not affected CNA

CPE configurations NVD · 10

CPEVersionsRoleVendor
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*8.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_aus:8.2:*:*:*:*:*:*:*8.2VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_aus:8.4:*:*:*:*:*:*:*8.4VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_aus:8.6:*:*:*:*:*:*:*8.6VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_eus:8.8:*:*:*:*:*:*:*8.8VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_tus:8.4:*:*:*:*:*:*:*8.4VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_tus:8.6:*:*:*:*:*:*:*8.6VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.4:*:*:*:*:*:*:*8.4VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.6:*:*:*:*:*:*:*8.6VulnerableRed Hat
  • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_aus:8.2:*:*:*:*:*:*:* Versions 8.2 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_aus:8.4:*:*:*:*:*:*:* Versions 8.4 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_aus:8.6:*:*:*:*:*:*:* Versions 8.6 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_eus:8.8:*:*:*:*:*:*:* Versions 8.8 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_tus:8.4:*:*:*:*:*:*:* Versions 8.4 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_tus:8.6:*:*:*:*:*:*:* Versions 8.6 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.4:*:*:*:*:*:*:* Versions 8.4 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.6:*:*:*:*:*:*:* Versions 8.6 Vulnerable ·Red Hat

Remediation

  • Fix · CNA freeipa Fixed in 4.12.1

Red Hat 9 advisories

  • RHSA-2024:3760 Released 2024-06-10 · Red Hat rating Important
    ipa security update
    • Red Hat Enterprise Linux Client (v. 7) ipa-4.6.8-5.el7_9.17, ipa-client-4.6.8-5.el7_9.17, ipa-client-common-4.6.8-5.el7_9.17 +4
    • Red Hat Enterprise Linux Client Optional (v. 7) ipa-server-4.6.8-5.el7_9.17, ipa-server-common-4.6.8-5.el7_9.17, ipa-server-dns-4.6.8-5.el7_9.17 +2
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) ipa-server-4.6.8-5.el7_9.17, ipa-server-common-4.6.8-5.el7_9.17, ipa-server-dns-4.6.8-5.el7_9.17 +2
    • Red Hat Enterprise Linux Server (v. 7) ipa-4.6.8-5.el7_9.17, ipa-client-4.6.8-5.el7_9.17, ipa-client-common-4.6.8-5.el7_9.17 +9
    • Red Hat Enterprise Linux Workstation (v. 7) ipa-4.6.8-5.el7_9.17, ipa-client-4.6.8-5.el7_9.17, ipa-client-common-4.6.8-5.el7_9.17 +9
  • RHSA-2024:3775 Released 2024-06-10 · Red Hat rating Important
    idm:DL1 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) bind-dyndb-ldap-11.6-4.module+el8.6.0+21751+4d78cb83.3.src::idm:DL1, bind-dyndb-ldap-11.6-4.module+el8.6.0+21751+4d78cb83.3.x86_64::idm:DL1, custodia-0.6.0-3.module+el8.1.0+4098+f286395e.noarch::idm:DL1 +39
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) bind-dyndb-ldap-11.6-4.module+el8.6.0+21751+4d78cb83.3.ppc64le::idm:DL1, bind-dyndb-ldap-11.6-4.module+el8.6.0+21751+4d78cb83.3.src::idm:DL1, bind-dyndb-ldap-11.6-4.module+el8.6.0+21751+4d78cb83.3.x86_64::idm:DL1 +47
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) bind-dyndb-ldap-11.6-4.module+el8.6.0+21751+4d78cb83.3.src::idm:DL1, bind-dyndb-ldap-11.6-4.module+el8.6.0+21751+4d78cb83.3.x86_64::idm:DL1, custodia-0.6.0-3.module+el8.1.0+4098+f286395e.noarch::idm:DL1 +39
  • RHSA-2024:3757 Released 2024-06-10 · Red Hat rating Important
    ipa security update
    • Red Hat CodeReady Linux Builder EUS (v.9.2) python3-ipatests-4.10.1-12.el9_2.2
    • Red Hat Enterprise Linux AppStream EUS (v.9.2) ipa-4.10.1-12.el9_2.2, ipa-client-4.10.1-12.el9_2.2, ipa-client-common-4.10.1-12.el9_2.2 +11
Show 6 more Red Hat advisories
  • RHSA-2024:3761 Released 2024-06-10 · Red Hat rating Important
    ipa security update
    • Red Hat CodeReady Linux Builder EUS (v.9.0) python3-ipatests-4.9.8-11.el9_0.3
    • Red Hat Enterprise Linux AppStream EUS (v.9.0) ipa-4.9.8-11.el9_0.3, ipa-client-4.9.8-11.el9_0.3, ipa-client-common-4.9.8-11.el9_0.3 +11
  • RHSA-2024:3759 Released 2024-06-10 · Red Hat rating Important
    idm:DL1 security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.8) bind-dyndb-ldap-11.6-4.module+el8.8.0+21675+157fa23b.2.aarch64::idm:DL1, bind-dyndb-ldap-11.6-4.module+el8.8.0+21675+157fa23b.2.ppc64le::idm:DL1, bind-dyndb-ldap-11.6-4.module+el8.8.0+21675+157fa23b.2.s390x::idm:DL1 +47
  • RHSA-2024:3755 Released 2024-06-10 · Red Hat rating Important
    idm:DL1 security update
    • Red Hat Enterprise Linux AppStream (v. 8) bind-dyndb-ldap-11.6-5.module+el8.10.0+21691+df63127d.aarch64::idm:DL1, bind-dyndb-ldap-11.6-5.module+el8.10.0+21691+df63127d.ppc64le::idm:DL1, bind-dyndb-ldap-11.6-5.module+el8.10.0+21691+df63127d.s390x::idm:DL1 +47
  • RHSA-2024:3754 Released 2024-06-10 · Red Hat rating Important
    ipa security update
    • Red Hat Enterprise Linux AppStream (v. 9) ipa-4.11.0-15.el9_4, ipa-client-4.11.0-15.el9_4, ipa-client-common-4.11.0-15.el9_4 +11
    • Red Hat Enterprise Linux CRB (v. 9) python3-ipatests-4.11.0-15.el9_4
  • RHSA-2024:3756 Released 2024-06-10 · Red Hat rating Important
    idm:DL1 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) bind-dyndb-ldap-11.6-2.module+el8.4.0+21736+855b82c8.1.src::idm:DL1, bind-dyndb-ldap-11.6-2.module+el8.4.0+21736+855b82c8.1.x86_64::idm:DL1, custodia-0.6.0-3.module+el8.1.0+4098+f286395e.noarch::idm:DL1 +39
    • Red Hat Enterprise Linux AppStream E4S (v.8.4) bind-dyndb-ldap-11.6-2.module+el8.4.0+21736+855b82c8.1.ppc64le::idm:DL1, bind-dyndb-ldap-11.6-2.module+el8.4.0+21736+855b82c8.1.src::idm:DL1, bind-dyndb-ldap-11.6-2.module+el8.4.0+21736+855b82c8.1.x86_64::idm:DL1 +47
    • Red Hat Enterprise Linux AppStream TUS (v.8.4) bind-dyndb-ldap-11.6-2.module+el8.4.0+21736+855b82c8.1.src::idm:DL1, bind-dyndb-ldap-11.6-2.module+el8.4.0+21736+855b82c8.1.x86_64::idm:DL1, custodia-0.6.0-3.module+el8.1.0+4098+f286395e.noarch::idm:DL1 +39
  • RHSA-2024:3758 Released 2024-06-10 · Red Hat rating Important
    idm:DL1 security update
    • Red Hat Enterprise Linux AppStream AUS (v. 8.2) bind-dyndb-ldap-11.2-3.module+el8.2.0+21753+7109ce90.3.src::idm:DL1, bind-dyndb-ldap-11.2-3.module+el8.2.0+21753+7109ce90.3.x86_64::idm:DL1, custodia-0.6.0-3.module+el8.1.0+4098+f286395e.noarch::idm:DL1 +38

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 and 3 more products — RHSA-2024:3754

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2024-02513 Freeipa: delegation rules allow a proxy service to impersonate any user to access another target servicePriority LOW 39
    Show all 2 records → Advisory →
  • Advisory ·

    Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 and 3 more products — RHSA-2024:3755

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2024-02513 Freeipa: delegation rules allow a proxy service to impersonate any user to access another target servicePriority LOW 39
    Show all 2 records → Advisory →
Show 2 more groups
  • Advisory ·

    Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 and 3 more products — RHSA-2024:3757

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2024-02513 Freeipa: delegation rules allow a proxy service to impersonate any user to access another target servicePriority LOW 39
    Show all 2 records → Advisory →
  • Advisory ·

    Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 and 3 more products — RHSA-2024:3759

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2024-02513 Freeipa: delegation rules allow a proxy service to impersonate any user to access another target servicePriority LOW 39
    Show all 2 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat CodeReady Linux Builder EUS (v.9.0)Fixed RHSA-2024:3761
Red Hat CodeReady Linux Builder EUS (v.9.2)Fixed RHSA-2024:3757
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2024:3755
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2024:3754
Red Hat Enterprise Linux AppStream AUS (v. 8.2)Fixed RHSA-2024:3758
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2024:3756
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2024:3775
Red Hat Enterprise Linux AppStream E4S (v.8.4)Fixed RHSA-2024:3756
Red Hat Enterprise Linux AppStream E4S (v.8.6)Fixed RHSA-2024:3775
Red Hat Enterprise Linux AppStream EUS (v.8.8)Fixed RHSA-2024:3759
Red Hat Enterprise Linux AppStream EUS (v.9.0)Fixed RHSA-2024:3761
Red Hat Enterprise Linux AppStream EUS (v.9.2)Fixed RHSA-2024:3757
Red Hat Enterprise Linux AppStream TUS (v.8.4)Fixed RHSA-2024:3756
Red Hat Enterprise Linux AppStream TUS (v.8.6)Fixed RHSA-2024:3775
Red Hat Enterprise Linux CRB (v. 9)Fixed RHSA-2024:3754
Red Hat Enterprise Linux Client (v. 7)Fixed RHSA-2024:3760
Red Hat Enterprise Linux Client Optional (v. 7)Fixed RHSA-2024:3760
Red Hat Enterprise Linux ComputeNode Optional (v. 7)Fixed RHSA-2024:3760
Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2024:3760
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2024:3760
Not affected: 2 products
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux AppStream E4S (v.8.6)

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-3183
  2. 2026-10-03 Alias added: GHSA-8g25-xmmm-86qm

References

Advisory 11

Other 1

  • TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-10530 Code injection in [UNKNOWN] RichFaces KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05157 GNU Bash through 4.3 processes trailing strings after function definitions in the values… KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-23530 Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf… KEVCVSS 3.1CRITICAL 9.3
  • TI-2021-17490 mod_proxy SSRF KEVCVSS 3.1CRITICAL 9.0
See all 1955 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences