8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
0.011 Low
EPSS
Percentile
84.0%
A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way the internal function ber_scanf() was used in some components of the IPA server, which parsed kerberos key data. An unauthenticated attacker who could trigger parsing of the krb principal key could cause the IPA server to crash or in some conditions, cause arbitrary code to be executed on the server hosting the IPA server.
access.redhat.com/errata/RHBA-2019:4268
access.redhat.com/errata/RHSA-2020:0378
bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14867
github.com/pypa/advisory-db/tree/main/vulns/ipa/PYSEC-2019-28.yaml
lists.fedoraproject.org/archives/list/[email protected]/message/67SEUWJAJ5RMH5K4Q6TS2I7HIMXUGNKF
lists.fedoraproject.org/archives/list/[email protected]/message/WLFL5XDCJ3WT6JCLCQVKHZBLHGW7PW4T
nvd.nist.gov/vuln/detail/CVE-2019-14867
www.freeipa.org/page/Releases/4.6.7
www.freeipa.org/page/Releases/4.7.4
www.freeipa.org/page/Releases/4.8.3
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
0.011 Low
EPSS
Percentile
84.0%