CVE-2017-11191

FreeIPA 4.x with API version 2.213 allows a remote authenticated users to bypass intended account-locking restrictions via an unlock action with an old session ID for the same user account that had been created for an earlier session. NOTE: Vendor states that issue does not exist in product and...

CVE-2017-11191

Summary: CVE-2017-11191 affects FreeIPA 4.x with API version 2.213, where a remote authenticated user can bypass account-locking by performing an unlock action using an old session ID for the same user. The vulnerability is described as a session hijacking/unlock bypass risk rooted in how unlocks...

PT-2017-11811 · Red Hat +1 · Freeipa +1

Name of the Vulnerable Software and Affected Versions: FreeIPA versions 4.x Description: The issue allows a remote authenticated user to bypass intended account-locking restrictions via an unlock action with an old session ID for the same user account that had been created for an earlier session...

Design/Logic Flaw

ipa-kra-install in FreeIPA before 4.2.2 puts the CA agent certificate and private key in /etc/httpd/alias/kra-agent.pem, which is world readable...

CVE-2015-5284

ipa-kra-install in FreeIPA before 4.2.2 puts the CA agent certificate and private key in /etc/httpd/alias/kra-agent.pem, which is world readable...

CVE-2015-5284

ipa-kra-install in FreeIPA before 4.2.2 puts the CA agent certificate and private key in /etc/httpd/alias/kra-agent.pem, which is world readable...

CVE-2015-5284

ipa-kra-install in FreeIPA before 4.2.2 puts the CA agent certificate and private key in /etc/httpd/alias/kra-agent.pem, which is world readable...

CVE-2015-5284

ipa-kra-install in FreeIPA before 4.2.2 puts the CA agent certificate and private key in /etc/httpd/alias/kra-agent.pem, which is world readable...

CVE-2015-5284

CVE-2015-5284 (FreeIPA) Impact: In FreeIPA versions before 4.2.2, ipa-kra-install stores the CA agent certificate and private key in /etc/httpd/alias/kra-agent.pem with world-readable permissions. This could allow an attacker to access the CA private key and potentially issue certificates (effect...

CVE-2015-5179

FreeIPA might display user data improperly via vectors involving non-printable characters...

UBUNTU-CVE-2015-5179

FreeIPA might display user data improperly via vectors involving non-printable characters...

CVE-2015-5179

FreeIPA might display user data improperly via vectors involving non-printable characters...

Design/Logic Flaw

FreeIPA might display user data improperly via vectors involving non-printable characters...

CVE-2015-5179

FreeIPA might display user data improperly via vectors involving non-printable characters...

DEBIAN-CVE-2015-5179

FreeIPA might display user data improperly via vectors involving non-printable characters...

CVE-2015-5179

FreeIPA might display user data improperly via vectors involving non-printable characters...

CVE-2015-5179

FreeIPA might display user data improperly via vectors involving non-printable characters...

CVE-2015-5179

Technical details (affected components, root cause, and patch status) are not publicly provided in the connected documents. Monitor vendor advisories and security trackers for updates.

FreeIPA Detection (HTTP)

HTTP based detection of FreeIPA. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.140334";...

FreeIPA < Multiple Vulnerabilities

FreeIPA is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:freeipa:freeipa"; if description...