Vulnerabilities

TI-2024-02983 CVE-2024-3183 · GHSA-8g25-xmmm-86qm

Freeipa: user can obtain a hash of the passwords of all domain users and perform offline brute force

MEDIUM 41

A vulnerability was found in FreeIPA in a way when a Kerberos TGS-REQ is encrypted using the client’s session key.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.02053 Published 2024-06-12 Fixed in 4.12.1, 4.6.8-5.el7_9.17 +8 CWE-916

TI-2024-02513 CVE-2024-2698 · GHSA-jhc8-v2x5-jvj5

Freeipa: delegation rules allow a proxy service to impersonate any user to access another target service

LOW 39

A vulnerability was found in FreeIPA in how the initial implementation of MS-SFU by MIT Kerberos was missing a condition for granting the "forwardable" flag on S4U2Self tickets.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00667 Published 2024-06-12 Partial fix · 4.11.2, 4.12.1 +4 CWE-863

Vulnerabilities

Filters

Freeipa: user can obtain a hash of the passwords of all domain users and perform offline brute force

Freeipa: delegation rules allow a proxy service to impersonate any user to access another target service