DEBIAN-CVE-2016-5404

The certrevoke command in FreeIPA does not check for the "revoke certificate" permission, which allows remote authenticated users to revoke arbitrary certificates by leveraging the "retrieve certificate" permission...

ipa: Insufficient privileges check in certificate revocation

An insufficient permission check issue was found in the way IPA server treats certificate revocation requests. An attacker logged in with the 'retrieve certificate' permission enabled could use this flaw to revoke certificates, possibly triggering a denial of service attack...

PT-2016-6410 · Red Hat +2 · Freeipa +3

Name of the Vulnerable Software and Affected Versions: FreeIPA affected versions not specified Description: The issue concerns the cert revoke command in FreeIPA, which fails to check for the revoke certificate permission. This allows remote authenticated users to revoke arbitrary certificates by...