Описание
A flaw was found in FreeIPA. This issue may allow a remote attacker to craft a HTTP request with parameters that can be interpreted as command arguments to kinit on the FreeIPA server, which can lead to a denial of service.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| freeipa | fixed | 4.12.2-1 | package | |
| freeipa | ignored | bookworm | package |
Примечания
https://bugzilla.redhat.com/show_bug.cgi?id=2262169
https://pagure.io/freeipa/issue/9541
Fixed by: https://pagure.io/freeipa/c/404fe1018e08e546fd14c83741e00b900c1cd208 (release-4-12-0)
Fixed by: https://pagure.io/freeipa/c/33af154b7f2c92e199d10a36a48310da9b7e77a8 (release-4-12-0)
ipa-4.10: https://pagure.io/freeipa/c/921661fd460799da69043e06e058cff75a64ce3c
ipa-4.10: https://pagure.io/freeipa/c/204011dc0514681511275a4b70a13bfa85c1a538
ipa-4.9: https://pagure.io/freeipa/c/b039f3087a13de3f34b230dbe29a7cfb1965700d
ipa-4.9: https://pagure.io/freeipa/c/96a478bbedd49c31e0f078f00f2d1cb55bb952fd
For buster (and most likely later versions) the vulnerable rpcserver.py code
is not part of the provided binary packages. The kinit.py file is however and
it is not entirelly clear whether this may be used in a vulnerable way when
the client is used for authentication purposes.
FreeIPA in Debian only builds the client packages, not the server
EPSS
Связанные уязвимости
A flaw was found in FreeIPA. This issue may allow a remote attacker to craft a HTTP request with parameters that can be interpreted as command arguments to kinit on the FreeIPA server, which can lead to a denial of service.
A flaw was found in FreeIPA. This issue may allow a remote attacker to craft a HTTP request with parameters that can be interpreted as command arguments to kinit on the FreeIPA server, which can lead to a denial of service.
A flaw was found in FreeIPA. This issue may allow a remote attacker to craft a HTTP request with parameters that can be interpreted as command arguments to kinit on the FreeIPA server, which can lead to a denial of service.
A flaw was found in FreeIPA. This issue may allow a remote attacker to craft a HTTP request with parameters that can be interpreted as command arguments to kinit on the FreeIPA server, which can lead to a denial of service.
EPSS