CVE-2012-5484

The CVE-2012-5484 issue affects FreeIPA 2.x and 3.x prior to 3.1.2 where the client fails to correctly obtain the CA certificate from the server, enabling a man-in-the-middle during the join procedure via a crafted certificate. Connected advisories indicate mitigations implemented in IPA client u...

CVE-2008-3274

The CVE-2008-3274 issue affects Red Hat Enterprise IPA 1.0.0 and FreeIPA before 1.1.1, where the default LDAP ACLs expose the krbMKey attribute to ldap:///anyone, allowing anonymous LDAP queries to leak the Kerberos master key. This is a read ACL misconfiguration that can impact confidentiality (...

CVE-2011-3636

CVE-2011-3636 describes a CSRF vulnerability in the FreeIPA management interface prior to 2.1.4. The flaw allows an attacker to hijack an administrator’s session and perform configuration-changing requests without authorization. Affected component: FreeIPA management UI. Root cause: CSRF in the w...

CVE-2013-0336

CVE-2013-0336 affects the FreeIPA dirsrv component: the ipapwd_chpwop function (ipa_pwd_extop.c) in the directory server allows a remote DoS (crash) via a connection request that omits a username/dn. Impact is described as a partial denial of service. The vulnerability is present in FreeIPA befor...

CVE-2013-0199

The CVE-2013-0199 entry affects FreeIPA 3.0 before 3.1.2. The default LDAP ACIs fail to restrict access to ipaNTTrustAuthIncoming and ipaNTTrustAuthOutgoing, enabling remote attackers to obtain the Cross-Realm Kerberos Trust key via unspecified vectors. The vulnerability arises from overly permis...