Every CVE Search/ Get API key

CVE-2026-11861

Freeipa: idm: ipa: freeipa: obtaining tgs with impersonating cname through trust relationships

9.6 Critical

A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket Granting Service (TGS) due to FreeIPA services not verifying Privilege Attribute Certificate (PAC) certificates. This vulnerability could allow an authenticated Active Directory user to escalate their privileges within the FreeIPA domain.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

0.36%Up 0.2 points since Aug 21, 2026
90%50%10%1%

What each source reports

CVE List Score used 9.6

Freeipa: idm: ipa: freeipa: obtaining tgs with impersonating cname through trust relationships

A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket Granting Service (TGS) due to FreeIPA services not verifying Privilege Attribute Certificate (PAC) certificates. This vulnerability could allow an authenticated Active Directory user to escalate their privileges within the FreeIPA domain.

Record
CVE-2026-11861
CVSS 3.1
9.6 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Weakness
CWE-266
Updated
2026-11-05
EUVDEUVD-2026-63245 9.6

A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket Granting Service (TGS) due to FreeIPA services not verifying Privilege Attribute Certificate (PAC) certificates. This vulnerability could allow an authenticated Active Directory user to escalate their privileges within the FreeIPA domain.

Record
EUVD-2026-63245
CVSS 3.1
9.6 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Updated
2026-11-05
GitHub AdvisoriesGHSA-g67c-jg9c-rqh2 9.6

A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active...

A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket Granting Service (TGS) due to FreeIPA services not verifying Privilege Attribute Certificate (PAC) certificates. This vulnerability could allow an authenticated Active Directory user to escalate their privileges within the FreeIPA domain.

Record
GHSA-g67c-jg9c-rqh2
CVSS 3.1
9.6 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Weakness
CWE-266
Updated
2026-11-02
NVD 9.6

A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket Granting Service (TGS) due to FreeIPA services not verifying Privilege Attribute Certificate (PAC) certificates. This vulnerability could allow an authenticated Active Directory user to escalate their privileges within the FreeIPA domain.

Record
CVE-2026-11861
CVSS 3.1
9.6 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-266
Updated
2026-11-05
OSV 9.6

Freeipa: idm: ipa: freeipa: obtaining tgs with impersonating cname through trust relationships

A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket Granting Service (TGS) due to FreeIPA services not verifying Privilege Attribute Certificate (PAC) certificates. This vulnerability could allow an authenticated Active Directory user to escalate their privileges within the FreeIPA domain.

Record
CVE-2026-11861
CVSS 3.1
9.6 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Weakness
CWE-266
Updated
2026-11-07
OSVDEBIAN-CVE-2026-11861 8.1

A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket Granting Service (TGS) due to FreeIPA services not verifying Privilege Attribute Certificate (PAC) certificates. This vulnerability could allow an authenticated Active Directory user to escalate their privileges within the FreeIPA domain.

Record
DEBIAN-CVE-2026-11861
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-07
Show 17 moreShow less
OSVRHSA-2026:70564 9.8

Red Hat Security Advisory: ipa security, bug fix, and enhancement update

Record
RHSA-2026:70564
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:72279 9.8

Red Hat Security Advisory: ipa security, bug fix, and enhancement update

Record
RHSA-2026:72279
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:82935 9.8

Red Hat Security Advisory: ipa security update

Record
RHSA-2026:82935
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:83083 9.8

Red Hat Security Advisory: ipa security update

Record
RHSA-2026:83083
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:83084 9.8

Red Hat Security Advisory: ipa security update

Record
RHSA-2026:83084
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:83085 9.8

Red Hat Security Advisory: ipa security, bug fix, and enhancement update

Record
RHSA-2026:83085
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:83460 9.8

Red Hat Security Advisory: idm:DL1 security, bug fix, and enhancement update

Record
RHSA-2026:83460
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:83461 9.8

Red Hat Security Advisory: idm:DL1 security, bug fix, and enhancement update

Record
RHSA-2026:83461
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:70564 9.8

Critical: ipa security, bug fix, and enhancement update

Rocky Enterprise Software Foundation Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments.

Security Fix(es):

  • ipa: FreeIPA: Unauthenticated DoS in /ipa/i18n_messages via Unbounded Request Body Read (CVE-2026-73198)

  • ipa: FreeIPA: Unauthenticated DoS in /ipa/migration/migration.py via Unbounded Request Body Read (CVE-2026-73197)

  • FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships (CVE-2026-11861)

  • freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL (CVE-2026-18147)

  • freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes (CVE-2026-19550)

  • ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore (CVE-2026-13097)

  • ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI (CVE-2026-76578)

  • freeIPA: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service (CVE-2026-79678)

Bug Fix(es) and Enhancement(s):

  • [Cursor Automated] Include latest fixes in python3-ipatests package [Rocky Linux9.8] (JIRA:Rocky Linux-170987)

  • WebUI Hardening [rhel-9.8.z] (JIRA:Rocky Linux-238511)

  • ipa-otptoken-import hardening [rhel-9.8.z] (JIRA:Rocky Linux-238519)

  • host-mod: handle the password attribute when set with --setattr userpassword= [rhel-9.8.z] (JIRA:Rocky Linux-238523)

  • ipa env: support only simple * wildcard [rhel-9.8.z] (JIRA:Rocky Linux-238527)

  • ipa-epn: drop_privileges method is mixing uid and gid [rhel-9.8.z] (JIRA:Rocky Linux-238674)

  • ipa-migrate: require Replication Administrator privilege [rhel-9.8.z] (JIRA:Rocky Linux-238677)

  • ipa-migrate tool is renaming host records & host info in automount information [rhel-9.8.z] (JIRA:Rocky Linux-240767)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:70564
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:72279 9.8

Critical: ipa security, bug fix, and enhancement update

Rocky Enterprise Software Foundation Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments.

Security Fix(es):

  • ipa: FreeIPA: Unauthenticated DoS in /ipa/i18n_messages via Unbounded Request Body Read (CVE-2026-73198)

  • ipa: FreeIPA: Unauthenticated DoS in /ipa/migration/migration.py via Unbounded Request Body Read (CVE-2026-73197)

  • FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships (CVE-2026-11861)

  • freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL (CVE-2026-18147)

  • freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes (CVE-2026-19550)

  • ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore (CVE-2026-13097)

  • ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI (CVE-2026-76578)

  • freeIPA: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service (CVE-2026-79678)

Bug Fix(es) and Enhancement(s):

  • [Cursor Automated] Include latest fixes in python3-ipatests package [Rocky Linux10.2] (JIRA:Rocky Linux-173375)

  • WebUI Hardening [rhel-10.2.z] (JIRA:Rocky Linux-238510)

  • ipa-otptoken-import hardening [rhel-10.2.z] (JIRA:Rocky Linux-238518)

  • host-mod: handle the password attribute when set with --setattr userpassword= [rhel-10.2.z] (JIRA:Rocky Linux-238522)

  • ipa env: support only simple * wildcard [rhel-10.2.z] (JIRA:Rocky Linux-238526)

  • ipa-epn: drop_privileges method is mixing uid and gid [rhel-10.2.z] (JIRA:Rocky Linux-238673)

  • ipa-migrate: require Replication Administrator privilege [rhel-10.2.z] (JIRA:Rocky Linux-238676)

  • ipa-migrate tool is renaming host records & host info in automount information [rhel-10.2.z] (JIRA:Rocky Linux-240768)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:72279
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:83460 9.8

Critical: idm:DL1 security, bug fix, and enhancement update

Rocky Enterprise Software Foundation Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments.

Security Fix(es):

  • ipa: FreeIPA: Unauthenticated DoS in /ipa/i18n_messages via Unbounded Request Body Read (CVE-2026-73198)

  • ipa: FreeIPA: Unauthenticated DoS in /ipa/migration/migration.py via Unbounded Request Body Read (CVE-2026-73197)

  • FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships (CVE-2026-11861)

  • freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL (CVE-2026-18147)

  • freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes (CVE-2026-19550)

  • ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore (CVE-2026-13097)

  • ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI (CVE-2026-76578)

  • freeIPA: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service (CVE-2026-79678)

Bug Fix(es) and Enhancement(s):

  • Fix ipatests for kdcproxy after CVE-2025-59088 fix [rhel-8.10.z] (JIRA:Rocky Linux-129966)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:83460
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-11861 9.6

A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket Granting Service (TGS) due to FreeIPA services not verifying Privilege Attribute Certificate (PAC) certificates. This vulnerability could allow an authenticated Active Directory user to escalate their privileges within the FreeIPA domain.

Record
UBUNTU-CVE-2026-11861
CVSS 3.1
9.6 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVALSA-2026:70564 No score

Critical: ipa security, bug fix, and enhancement update

AlmaLinux Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments.

Security Fix(es):

  • ipa: FreeIPA: Unauthenticated DoS in /ipa/i18n_messages via Unbounded Request Body Read (CVE-2026-73198)
  • ipa: FreeIPA: Unauthenticated DoS in /ipa/migration/migration.py via Unbounded Request Body Read (CVE-2026-73197)
  • FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships (CVE-2026-11861)
  • freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL (CVE-2026-18147)
  • freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes (CVE-2026-19550)
  • ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore (CVE-2026-13097)
  • ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI (CVE-2026-76578)
  • freeIPA: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service (CVE-2026-79678)

Bug Fix(es) and Enhancement(s):

  • [Cursor Automated] Include latest fixes in python3-ipatests package [AlmaLinux9.8] (JIRA:AlmaLinux-170987)
  • WebUI Hardening [almalinux-9.8.z] (JIRA:AlmaLinux-238511)
  • ipa-otptoken-import hardening [almalinux-9.8.z] (JIRA:AlmaLinux-238519)
  • host-mod: handle the password attribute when set with --setattr userpassword= [almalinux-9.8.z] (JIRA:AlmaLinux-238523)
  • ipa env: support only simple * wildcard [almalinux-9.8.z] (JIRA:AlmaLinux-238527)
  • ipa-epn: drop_privileges method is mixing uid and gid [almalinux-9.8.z] (JIRA:AlmaLinux-238674)
  • ipa-migrate: require Replication Administrator privilege [almalinux-9.8.z] (JIRA:AlmaLinux-238677)
  • ipa-migrate tool is renaming host records & host info in automount information [almalinux-9.8.z] (JIRA:AlmaLinux-240767)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:70564
Updated
2026-11-02
OSVALSA-2026:72279 No score

Critical: ipa security, bug fix, and enhancement update

AlmaLinux Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments.

Security Fix(es):

  • ipa: FreeIPA: Unauthenticated DoS in /ipa/i18n_messages via Unbounded Request Body Read (CVE-2026-73198)
  • ipa: FreeIPA: Unauthenticated DoS in /ipa/migration/migration.py via Unbounded Request Body Read (CVE-2026-73197)
  • FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships (CVE-2026-11861)
  • freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL (CVE-2026-18147)
  • freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes (CVE-2026-19550)
  • ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore (CVE-2026-13097)
  • ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI (CVE-2026-76578)
  • freeIPA: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service (CVE-2026-79678)

Bug Fix(es) and Enhancement(s):

  • [Cursor Automated] Include latest fixes in python3-ipatests package [AlmaLinux10.2] (JIRA:AlmaLinux-173375)
  • WebUI Hardening [almalinux-10.2.z] (JIRA:AlmaLinux-238510)
  • ipa-otptoken-import hardening [almalinux-10.2.z] (JIRA:AlmaLinux-238518)
  • host-mod: handle the password attribute when set with --setattr userpassword= [almalinux-10.2.z] (JIRA:AlmaLinux-238522)
  • ipa env: support only simple * wildcard [almalinux-10.2.z] (JIRA:AlmaLinux-238526)
  • ipa-epn: drop_privileges method is mixing uid and gid [almalinux-10.2.z] (JIRA:AlmaLinux-238673)
  • ipa-migrate: require Replication Administrator privilege [almalinux-10.2.z] (JIRA:AlmaLinux-238676)
  • ipa-migrate tool is renaming host records & host info in automount information [almalinux-10.2.z] (JIRA:AlmaLinux-240768)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:72279
Updated
2026-11-02
OSVALSA-2026:83460 No score

Critical: idm:DL1 security, bug fix, and enhancement update

AlmaLinux Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments.

Security Fix(es):

  • ipa: FreeIPA: Unauthenticated DoS in /ipa/i18n_messages via Unbounded Request Body Read (CVE-2026-73198)
  • ipa: FreeIPA: Unauthenticated DoS in /ipa/migration/migration.py via Unbounded Request Body Read (CVE-2026-73197)
  • FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships (CVE-2026-11861)
  • freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL (CVE-2026-18147)
  • freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes (CVE-2026-19550)
  • ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore (CVE-2026-13097)
  • ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI (CVE-2026-76578)
  • freeIPA: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service (CVE-2026-79678)

Bug Fix(es) and Enhancement(s):

  • Fix ipatests for kdcproxy after CVE-2025-59088 fix [almalinux-8.10.z] (JIRA:AlmaLinux-129966)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:83460
Updated
2026-11-02
OSVCLSA-2026-1791364402 No score

ipa: Fix of 8 CVEs

  • CVE-2026-76578: constrain the self-managed OTP token ACI, deny anonymous modifications and harden self-service and delegated-write ACIs
  • CVE-2026-79678: enforce managed permissions before LDAP-oriented commands run their callbacks, and require privileges for RA-agent backed operations
  • CVE-2026-13097: enforce Kerberos principal name uniqueness with a principal-aware matching rule (new ipa-krbprinc-mr 389-ds plugin)
  • CVE-2026-11861: validate the PAC of cross-realm trust tickets in the KDB driver, including ID override checks
  • CVE-2026-73198: limit the request body size of the unauthenticated /ipa/i18n_messages endpoint
  • CVE-2026-73197: reject oversized Content-Length in the unauthenticated password migration endpoint
  • CVE-2026-19550: require write access to the trust entry for trust-fetch-domains
  • CVE-2026-18147: remove the redirect from the Web UI password reset page
Record
CLSA-2026-1791364402
Updated
2026-11-02
OSVCLSA-2026-1791544796 No score

ipa: Fix of 4 CVEs

  • CVE-2026-11861: validate the PAC of cross-realm trust tickets in the KDB driver, including ID override checks
  • CVE-2026-13097: enforce Kerberos principal name uniqueness with a principal-aware matching rule (new ipa-krbprinc-mr 389-ds plugin)
  • CVE-2026-18147: remove the arbitrary URL redirect from the Web UI password reset page
  • CVE-2026-19550: require write access to the trust entry before refreshing trust domains
  • do not fail ipa-server or ipa-server-trust-ad removal on hosts without a running systemd, such as container images: the dbus and oddjobd reload calls in the install and removal scriptlets now tolerate failure, like the stop, disable and condrestart calls beside them
Record
CLSA-2026-1791544796
Updated
2026-11-02

Affected products

Show 5 moreShow less

Affected packages

Affected packages
PackageAffectedFixed
ipa-client
AlmaLinux:9
From an advisory covering 8 CVEs
 before 4.13.4-1.el9_8
4.13.4-1.el9_8
ipa-client-common
AlmaLinux:9
From an advisory covering 8 CVEs
 before 4.13.4-1.el9_8
4.13.4-1.el9_8
ipa-client-encrypted-dns
AlmaLinux:9
From an advisory covering 8 CVEs
 before 4.13.4-1.el9_8
4.13.4-1.el9_8
ipa-client-epn
AlmaLinux:9
From an advisory covering 8 CVEs
 before 4.13.4-1.el9_8
4.13.4-1.el9_8
ipa-client-samba
AlmaLinux:9
From an advisory covering 8 CVEs
 before 4.13.4-1.el9_8
4.13.4-1.el9_8
ipa-common
AlmaLinux:9
From an advisory covering 8 CVEs
 before 4.13.4-1.el9_8
4.13.4-1.el9_8
ipa-selinux
AlmaLinux:9
From an advisory covering 8 CVEs
 before 4.13.4-1.el9_8
4.13.4-1.el9_8
ipa-selinux-luna
AlmaLinux:9
From an advisory covering 8 CVEs
 before 4.13.4-1.el9_8
4.13.4-1.el9_8
ipa-selinux-nfast
AlmaLinux:9
From an advisory covering 8 CVEs
 before 4.13.4-1.el9_8
4.13.4-1.el9_8
ipa-server
AlmaLinux:9
From an advisory covering 8 CVEs
 before 4.13.4-1.el9_8
4.13.4-1.el9_8
Show 290 moreShow less
Affected packages
PackageAffectedFixed
ipa-server-common
AlmaLinux:9
From an advisory covering 8 CVEs
 before 4.13.4-1.el9_8
4.13.4-1.el9_8
ipa-server-dns
AlmaLinux:9
From an advisory covering 8 CVEs
 before 4.13.4-1.el9_8
4.13.4-1.el9_8
ipa-server-encrypted-dns
AlmaLinux:9
From an advisory covering 8 CVEs
 before 4.13.4-1.el9_8
4.13.4-1.el9_8
ipa-server-trust-ad
AlmaLinux:9
From an advisory covering 8 CVEs
 before 4.13.4-1.el9_8
4.13.4-1.el9_8
python3-ipaclient
AlmaLinux:9
From an advisory covering 8 CVEs
 before 4.13.4-1.el9_8
4.13.4-1.el9_8
python3-ipalib
AlmaLinux:9
From an advisory covering 8 CVEs
 before 4.13.4-1.el9_8
4.13.4-1.el9_8
python3-ipaserver
AlmaLinux:9
From an advisory covering 8 CVEs
 before 4.13.4-1.el9_8
4.13.4-1.el9_8
python3-ipatests
AlmaLinux:9
From an advisory covering 8 CVEs
 before 4.13.4-1.el9_8
4.13.4-1.el9_8
ipa-client
AlmaLinux:10
From an advisory covering 8 CVEs
 before 4.13.4-1.el10_2
4.13.4-1.el10_2
ipa-client-common
AlmaLinux:10
From an advisory covering 8 CVEs
 before 4.13.4-1.el10_2
4.13.4-1.el10_2
ipa-client-encrypted-dns
AlmaLinux:10
From an advisory covering 8 CVEs
 before 4.13.4-1.el10_2
4.13.4-1.el10_2
ipa-client-epn
AlmaLinux:10
From an advisory covering 8 CVEs
 before 4.13.4-1.el10_2
4.13.4-1.el10_2
ipa-client-samba
AlmaLinux:10
From an advisory covering 8 CVEs
 before 4.13.4-1.el10_2
4.13.4-1.el10_2
ipa-common
AlmaLinux:10
From an advisory covering 8 CVEs
 before 4.13.4-1.el10_2
4.13.4-1.el10_2
ipa-selinux
AlmaLinux:10
From an advisory covering 8 CVEs
 before 4.13.4-1.el10_2
4.13.4-1.el10_2
ipa-selinux-luna
AlmaLinux:10
From an advisory covering 8 CVEs
 before 4.13.4-1.el10_2
4.13.4-1.el10_2
ipa-selinux-nfast
AlmaLinux:10
From an advisory covering 8 CVEs
 before 4.13.4-1.el10_2
4.13.4-1.el10_2
ipa-server
AlmaLinux:10
From an advisory covering 8 CVEs
 before 4.13.4-1.el10_2
4.13.4-1.el10_2
ipa-server-common
AlmaLinux:10
From an advisory covering 8 CVEs
 before 4.13.4-1.el10_2
4.13.4-1.el10_2
ipa-server-dns
AlmaLinux:10
From an advisory covering 8 CVEs
 before 4.13.4-1.el10_2
4.13.4-1.el10_2
ipa-server-encrypted-dns
AlmaLinux:10
From an advisory covering 8 CVEs
 before 4.13.4-1.el10_2
4.13.4-1.el10_2
ipa-server-trust-ad
AlmaLinux:10
From an advisory covering 8 CVEs
 before 4.13.4-1.el10_2
4.13.4-1.el10_2
python3-ipaclient
AlmaLinux:10
From an advisory covering 8 CVEs
 before 4.13.4-1.el10_2
4.13.4-1.el10_2
python3-ipalib
AlmaLinux:10
From an advisory covering 8 CVEs
 before 4.13.4-1.el10_2
4.13.4-1.el10_2
python3-ipaserver
AlmaLinux:10
From an advisory covering 8 CVEs
 before 4.13.4-1.el10_2
4.13.4-1.el10_2
python3-ipatests
AlmaLinux:10
From an advisory covering 8 CVEs
 before 4.13.4-1.el10_2
4.13.4-1.el10_2
bind-dyndb-ldap
AlmaLinux:8
From an advisory covering 9 CVEs
 before 11.6-6.module_el8.10.0+3980+d78e8e90
11.6-6.module_el8.10.0+3980+d78e8e90
custodia
AlmaLinux:8
From an advisory covering 9 CVEs
 before 0.6.0-3.module_el8.6.0+2881+2f24dc92
0.6.0-3.module_el8.6.0+2881+2f24dc92
ipa-client
AlmaLinux:8
From an advisory covering 9 CVEs
 before 4.9.13-21.module_el8.10.0+4302+2d2000af.3
4.9.13-21.module_el8.10.0+4302+2d2000af.3
ipa-client-common
AlmaLinux:8
From an advisory covering 9 CVEs
 before 4.9.13-21.module_el8.10.0+4302+2d2000af.3
4.9.13-21.module_el8.10.0+4302+2d2000af.3
ipa-client-epn
AlmaLinux:8
From an advisory covering 9 CVEs
 before 4.9.13-21.module_el8.10.0+4302+2d2000af.3
4.9.13-21.module_el8.10.0+4302+2d2000af.3
ipa-client-samba
AlmaLinux:8
From an advisory covering 9 CVEs
 before 4.9.13-21.module_el8.10.0+4302+2d2000af.3
4.9.13-21.module_el8.10.0+4302+2d2000af.3
ipa-common
AlmaLinux:8
From an advisory covering 9 CVEs
 before 4.9.13-21.module_el8.10.0+4302+2d2000af.3
4.9.13-21.module_el8.10.0+4302+2d2000af.3
ipa-healthcheck
AlmaLinux:8
From an advisory covering 9 CVEs
 before 0.12-6.module_el8.10.0+4036+84b152d9
0.12-6.module_el8.10.0+4036+84b152d9
ipa-healthcheck-core
AlmaLinux:8
From an advisory covering 9 CVEs
 before 0.12-6.module_el8.10.0+4036+84b152d9
0.12-6.module_el8.10.0+4036+84b152d9
ipa-python-compat
AlmaLinux:8
From an advisory covering 9 CVEs
 before 4.9.13-21.module_el8.10.0+4302+2d2000af.3
4.9.13-21.module_el8.10.0+4302+2d2000af.3
ipa-selinux
AlmaLinux:8
From an advisory covering 9 CVEs
 before 4.9.13-21.module_el8.10.0+4302+2d2000af.3
4.9.13-21.module_el8.10.0+4302+2d2000af.3
ipa-server
AlmaLinux:8
From an advisory covering 9 CVEs
 before 4.9.13-21.module_el8.10.0+4302+2d2000af.3
4.9.13-21.module_el8.10.0+4302+2d2000af.3
ipa-server-common
AlmaLinux:8
From an advisory covering 9 CVEs
 before 4.9.13-21.module_el8.10.0+4302+2d2000af.3
4.9.13-21.module_el8.10.0+4302+2d2000af.3
ipa-server-dns
AlmaLinux:8
From an advisory covering 9 CVEs
 before 4.9.13-21.module_el8.10.0+4302+2d2000af.3
4.9.13-21.module_el8.10.0+4302+2d2000af.3
ipa-server-trust-ad
AlmaLinux:8
From an advisory covering 9 CVEs
 before 4.9.13-21.module_el8.10.0+4302+2d2000af.3
4.9.13-21.module_el8.10.0+4302+2d2000af.3
opendnssec
AlmaLinux:8
From an advisory covering 9 CVEs
 before 2.1.7-2.module_el8.10.0+3980+d78e8e90
2.1.7-2.module_el8.10.0+3980+d78e8e90
python3-custodia
AlmaLinux:8
From an advisory covering 9 CVEs
 before 0.6.0-3.module_el8.6.0+2881+2f24dc92
0.6.0-3.module_el8.6.0+2881+2f24dc92
python3-ipaclient
AlmaLinux:8
From an advisory covering 9 CVEs
 before 4.9.13-21.module_el8.10.0+4302+2d2000af.3
4.9.13-21.module_el8.10.0+4302+2d2000af.3
python3-ipalib
AlmaLinux:8
From an advisory covering 9 CVEs
 before 4.9.13-21.module_el8.10.0+4302+2d2000af.3
4.9.13-21.module_el8.10.0+4302+2d2000af.3
python3-ipaserver
AlmaLinux:8
From an advisory covering 9 CVEs
 before 4.9.13-21.module_el8.10.0+4302+2d2000af.3
4.9.13-21.module_el8.10.0+4302+2d2000af.3
python3-ipatests
AlmaLinux:8
From an advisory covering 9 CVEs
 before 4.9.13-21.module_el8.10.0+4302+2d2000af.3
4.9.13-21.module_el8.10.0+4302+2d2000af.3
python3-jwcrypto
AlmaLinux:8
From an advisory covering 9 CVEs
 before 0.5.0-2.module_el8.10.0+3844+20e075e5
0.5.0-2.module_el8.10.0+3844+20e075e5
python3-kdcproxy
AlmaLinux:8
From an advisory covering 9 CVEs
 before 0.4-5.module_el8.10.0+4069+1d9eaa78.2
0.4-5.module_el8.10.0+4069+1d9eaa78.2
python3-pyusb
AlmaLinux:8
From an advisory covering 9 CVEs
 before 1.0.0-9.1.module_el8.7.0+3349+cfeff52e
1.0.0-9.1.module_el8.7.0+3349+cfeff52e
python3-qrcode
AlmaLinux:8
From an advisory covering 9 CVEs
 before 5.3-1.module_el8.10.0+3942+63b39a46
5.3-1.module_el8.10.0+3942+63b39a46
python3-qrcode-core
AlmaLinux:8
From an advisory covering 9 CVEs
 before 5.3-1.module_el8.10.0+3942+63b39a46
5.3-1.module_el8.10.0+3942+63b39a46
python3-yubico
AlmaLinux:8
From an advisory covering 9 CVEs
 before 1.3.2-9.1.module_el8.7.0+3349+cfeff52e
1.3.2-9.1.module_el8.7.0+3349+cfeff52e
slapi-nis
AlmaLinux:8
From an advisory covering 9 CVEs
 before 0.60.0-4.module_el8.10.0+3844+20e075e5.alma.1
0.60.0-4.module_el8.10.0+3844+20e075e5.alma.1
softhsm
AlmaLinux:8
From an advisory covering 9 CVEs
 before 2.6.0-5.module_el8.6.0+2881+2f24dc92
2.6.0-5.module_el8.6.0+2881+2f24dc92
softhsm
AlmaLinux:8
From an advisory covering 9 CVEs
 before 2.6.0-5.module_el8.6.0+3031+2f24dc92
2.6.0-5.module_el8.6.0+3031+2f24dc92
softhsm-devel
AlmaLinux:8
From an advisory covering 9 CVEs
 before 2.6.0-5.module_el8.6.0+2881+2f24dc92
2.6.0-5.module_el8.6.0+2881+2f24dc92
softhsm-devel
AlmaLinux:8
From an advisory covering 9 CVEs
 before 2.6.0-5.module_el8.6.0+3031+2f24dc92
2.6.0-5.module_el8.6.0+3031+2f24dc92
ipa-client
TuxCare:AlmaLinux:9.6
From an advisory covering 8 CVEs
 before 4.12.2-14.0.1.el9_6.5.tuxcare.els3
4.12.2-14.0.1.el9_6.5.tuxcare.els3
ipa-client-common
TuxCare:AlmaLinux:9.6
From an advisory covering 8 CVEs
 before 4.12.2-14.0.1.el9_6.5.tuxcare.els3
4.12.2-14.0.1.el9_6.5.tuxcare.els3
ipa-client-encrypted-dns
TuxCare:AlmaLinux:9.6
From an advisory covering 8 CVEs
 before 4.12.2-14.0.1.el9_6.5.tuxcare.els3
4.12.2-14.0.1.el9_6.5.tuxcare.els3
ipa-client-epn
TuxCare:AlmaLinux:9.6
From an advisory covering 8 CVEs
 before 4.12.2-14.0.1.el9_6.5.tuxcare.els3
4.12.2-14.0.1.el9_6.5.tuxcare.els3
ipa-client-samba
TuxCare:AlmaLinux:9.6
From an advisory covering 8 CVEs
 before 4.12.2-14.0.1.el9_6.5.tuxcare.els3
4.12.2-14.0.1.el9_6.5.tuxcare.els3
ipa-common
TuxCare:AlmaLinux:9.6
From an advisory covering 8 CVEs
 before 4.12.2-14.0.1.el9_6.5.tuxcare.els3
4.12.2-14.0.1.el9_6.5.tuxcare.els3
ipa-python-compat
TuxCare:AlmaLinux:9.6
From an advisory covering 8 CVEs
 before 4.12.2-14.0.1.el9_6.5.tuxcare.els3
4.12.2-14.0.1.el9_6.5.tuxcare.els3
ipa-selinux
TuxCare:AlmaLinux:9.6
From an advisory covering 8 CVEs
 before 4.12.2-14.0.1.el9_6.5.tuxcare.els3
4.12.2-14.0.1.el9_6.5.tuxcare.els3
ipa-selinux-luna
TuxCare:AlmaLinux:9.6
From an advisory covering 8 CVEs
 before 4.12.2-14.0.1.el9_6.5.tuxcare.els3
4.12.2-14.0.1.el9_6.5.tuxcare.els3
ipa-selinux-nfast
TuxCare:AlmaLinux:9.6
From an advisory covering 8 CVEs
 before 4.12.2-14.0.1.el9_6.5.tuxcare.els3
4.12.2-14.0.1.el9_6.5.tuxcare.els3
ipa-server
TuxCare:AlmaLinux:9.6
From an advisory covering 8 CVEs
 before 4.12.2-14.0.1.el9_6.5.tuxcare.els3
4.12.2-14.0.1.el9_6.5.tuxcare.els3
ipa-server-common
TuxCare:AlmaLinux:9.6
From an advisory covering 8 CVEs
 before 4.12.2-14.0.1.el9_6.5.tuxcare.els3
4.12.2-14.0.1.el9_6.5.tuxcare.els3
ipa-server-dns
TuxCare:AlmaLinux:9.6
From an advisory covering 8 CVEs
 before 4.12.2-14.0.1.el9_6.5.tuxcare.els3
4.12.2-14.0.1.el9_6.5.tuxcare.els3
ipa-server-encrypted-dns
TuxCare:AlmaLinux:9.6
From an advisory covering 8 CVEs
 before 4.12.2-14.0.1.el9_6.5.tuxcare.els3
4.12.2-14.0.1.el9_6.5.tuxcare.els3
ipa-server-trust-ad
TuxCare:AlmaLinux:9.6
From an advisory covering 8 CVEs
 before 4.12.2-14.0.1.el9_6.5.tuxcare.els3
4.12.2-14.0.1.el9_6.5.tuxcare.els3
python3-ipaclient
TuxCare:AlmaLinux:9.6
From an advisory covering 8 CVEs
 before 4.12.2-14.0.1.el9_6.5.tuxcare.els3
4.12.2-14.0.1.el9_6.5.tuxcare.els3
python3-ipalib
TuxCare:AlmaLinux:9.6
From an advisory covering 8 CVEs
 before 4.12.2-14.0.1.el9_6.5.tuxcare.els3
4.12.2-14.0.1.el9_6.5.tuxcare.els3
python3-ipaserver
TuxCare:AlmaLinux:9.6
From an advisory covering 8 CVEs
 before 4.12.2-14.0.1.el9_6.5.tuxcare.els3
4.12.2-14.0.1.el9_6.5.tuxcare.els3
python3-ipatests
TuxCare:AlmaLinux:9.6
From an advisory covering 8 CVEs
 before 4.12.2-14.0.1.el9_6.5.tuxcare.els3
4.12.2-14.0.1.el9_6.5.tuxcare.els3
ipa-client
TuxCare:AlmaLinux:9.2
From an advisory covering 4 CVEs
 before 4.10.1-9.el9_2.alma.1.tuxcare.els4
4.10.1-9.el9_2.alma.1.tuxcare.els4
ipa-client-common
TuxCare:AlmaLinux:9.2
From an advisory covering 4 CVEs
 before 4.10.1-9.el9_2.alma.1.tuxcare.els4
4.10.1-9.el9_2.alma.1.tuxcare.els4
ipa-client-epn
TuxCare:AlmaLinux:9.2
From an advisory covering 4 CVEs
 before 4.10.1-9.el9_2.alma.1.tuxcare.els4
4.10.1-9.el9_2.alma.1.tuxcare.els4
ipa-client-samba
TuxCare:AlmaLinux:9.2
From an advisory covering 4 CVEs
 before 4.10.1-9.el9_2.alma.1.tuxcare.els4
4.10.1-9.el9_2.alma.1.tuxcare.els4
ipa-common
TuxCare:AlmaLinux:9.2
From an advisory covering 4 CVEs
 before 4.10.1-9.el9_2.alma.1.tuxcare.els4
4.10.1-9.el9_2.alma.1.tuxcare.els4
ipa-python-compat
TuxCare:AlmaLinux:9.2
From an advisory covering 4 CVEs
 before 4.10.1-9.el9_2.alma.1.tuxcare.els4
4.10.1-9.el9_2.alma.1.tuxcare.els4
ipa-selinux
TuxCare:AlmaLinux:9.2
From an advisory covering 4 CVEs
 before 4.10.1-9.el9_2.alma.1.tuxcare.els4
4.10.1-9.el9_2.alma.1.tuxcare.els4
ipa-server
TuxCare:AlmaLinux:9.2
From an advisory covering 4 CVEs
 before 4.10.1-9.el9_2.alma.1.tuxcare.els4
4.10.1-9.el9_2.alma.1.tuxcare.els4
ipa-server-common
TuxCare:AlmaLinux:9.2
From an advisory covering 4 CVEs
 before 4.10.1-9.el9_2.alma.1.tuxcare.els4
4.10.1-9.el9_2.alma.1.tuxcare.els4
ipa-server-dns
TuxCare:AlmaLinux:9.2
From an advisory covering 4 CVEs
 before 4.10.1-9.el9_2.alma.1.tuxcare.els4
4.10.1-9.el9_2.alma.1.tuxcare.els4
ipa-server-trust-ad
TuxCare:AlmaLinux:9.2
From an advisory covering 4 CVEs
 before 4.10.1-9.el9_2.alma.1.tuxcare.els4
4.10.1-9.el9_2.alma.1.tuxcare.els4
python3-ipaclient
TuxCare:AlmaLinux:9.2
From an advisory covering 4 CVEs
 before 4.10.1-9.el9_2.alma.1.tuxcare.els4
4.10.1-9.el9_2.alma.1.tuxcare.els4
python3-ipalib
TuxCare:AlmaLinux:9.2
From an advisory covering 4 CVEs
 before 4.10.1-9.el9_2.alma.1.tuxcare.els4
4.10.1-9.el9_2.alma.1.tuxcare.els4
python3-ipaserver
TuxCare:AlmaLinux:9.2
From an advisory covering 4 CVEs
 before 4.10.1-9.el9_2.alma.1.tuxcare.els4
4.10.1-9.el9_2.alma.1.tuxcare.els4
python3-ipatests
TuxCare:AlmaLinux:9.2
From an advisory covering 4 CVEs
 before 4.10.1-9.el9_2.alma.1.tuxcare.els4
4.10.1-9.el9_2.alma.1.tuxcare.els4
freeipa
Debian:12
 All versions, plus listed versions
4.10.1+dfsg1-1+exp14.10.1-1+exp14.10.2-14.10.2-24.10.2-2+exp1
Show 14 moreShow less
4.11.1-14.11.1-1+exp14.11.1-24.11.1-2+exp14.11.1-2.14.12.2-14.12.2-24.12.2-34.12.4-14.12.4-24.13.1-14.9.11-14.9.11-1+exp14.9.11-2
 None known
freeipa
Debian:13
 All versions, plus listed versions
4.12.4-14.12.4-24.13.1-1
 None known
freeipa
Debian:14
 All versions, plus listed versions
4.12.4-14.12.4-24.13.1-1
 None known
ipa
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 0:4.13.4-1.el9_8
0:4.13.4-1.el9_8
ipa-client
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 0:4.13.4-1.el9_8
0:4.13.4-1.el9_8
ipa-client-common
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 0:4.13.4-1.el9_8
0:4.13.4-1.el9_8
ipa-client-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 0:4.13.4-1.el9_8
0:4.13.4-1.el9_8
ipa-client-encrypted-dns
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 0:4.13.4-1.el9_8
0:4.13.4-1.el9_8
ipa-client-epn
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 0:4.13.4-1.el9_8
0:4.13.4-1.el9_8
ipa-client-samba
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 0:4.13.4-1.el9_8
0:4.13.4-1.el9_8
ipa-common
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 0:4.13.4-1.el9_8
0:4.13.4-1.el9_8
ipa-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 0:4.13.4-1.el9_8
0:4.13.4-1.el9_8
ipa-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 0:4.13.4-1.el9_8
0:4.13.4-1.el9_8
ipa-selinux
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 0:4.13.4-1.el9_8
0:4.13.4-1.el9_8
ipa-selinux-luna
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 0:4.13.4-1.el9_8
0:4.13.4-1.el9_8
ipa-selinux-nfast
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 0:4.13.4-1.el9_8
0:4.13.4-1.el9_8
ipa-server
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 0:4.13.4-1.el9_8
0:4.13.4-1.el9_8
ipa-server-common
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 0:4.13.4-1.el9_8
0:4.13.4-1.el9_8
ipa-server-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 0:4.13.4-1.el9_8
0:4.13.4-1.el9_8
ipa-server-dns
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 0:4.13.4-1.el9_8
0:4.13.4-1.el9_8
ipa-server-encrypted-dns
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 0:4.13.4-1.el9_8
0:4.13.4-1.el9_8
ipa-server-trust-ad
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 0:4.13.4-1.el9_8
0:4.13.4-1.el9_8
ipa-server-trust-ad-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 0:4.13.4-1.el9_8
0:4.13.4-1.el9_8
python3-ipaclient
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 0:4.13.4-1.el9_8
0:4.13.4-1.el9_8
python3-ipalib
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 0:4.13.4-1.el9_8
0:4.13.4-1.el9_8
python3-ipaserver
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 0:4.13.4-1.el9_8
0:4.13.4-1.el9_8
python3-ipatests
Red Hat:enterprise_linux:9::crb
From an advisory covering 8 CVEs
 before 0:4.13.4-1.el9_8
0:4.13.4-1.el9_8
ipa
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
 before 0:4.13.4-1.el10_2
0:4.13.4-1.el10_2
ipa-client
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
 before 0:4.13.4-1.el10_2
0:4.13.4-1.el10_2
ipa-client-common
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
 before 0:4.13.4-1.el10_2
0:4.13.4-1.el10_2
ipa-client-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
 before 0:4.13.4-1.el10_2
0:4.13.4-1.el10_2
ipa-client-encrypted-dns
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
 before 0:4.13.4-1.el10_2
0:4.13.4-1.el10_2
ipa-client-epn
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
 before 0:4.13.4-1.el10_2
0:4.13.4-1.el10_2
ipa-client-samba
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
 before 0:4.13.4-1.el10_2
0:4.13.4-1.el10_2
ipa-common
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
 before 0:4.13.4-1.el10_2
0:4.13.4-1.el10_2
ipa-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
 before 0:4.13.4-1.el10_2
0:4.13.4-1.el10_2
ipa-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
 before 0:4.13.4-1.el10_2
0:4.13.4-1.el10_2
ipa-selinux
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
 before 0:4.13.4-1.el10_2
0:4.13.4-1.el10_2
ipa-selinux-luna
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
 before 0:4.13.4-1.el10_2
0:4.13.4-1.el10_2
ipa-selinux-nfast
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
 before 0:4.13.4-1.el10_2
0:4.13.4-1.el10_2
ipa-server
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
 before 0:4.13.4-1.el10_2
0:4.13.4-1.el10_2
ipa-server-common
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
 before 0:4.13.4-1.el10_2
0:4.13.4-1.el10_2
ipa-server-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
 before 0:4.13.4-1.el10_2
0:4.13.4-1.el10_2
ipa-server-dns
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
 before 0:4.13.4-1.el10_2
0:4.13.4-1.el10_2
ipa-server-encrypted-dns
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
 before 0:4.13.4-1.el10_2
0:4.13.4-1.el10_2
ipa-server-trust-ad
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
 before 0:4.13.4-1.el10_2
0:4.13.4-1.el10_2
ipa-server-trust-ad-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
 before 0:4.13.4-1.el10_2
0:4.13.4-1.el10_2
python3-ipaclient
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
 before 0:4.13.4-1.el10_2
0:4.13.4-1.el10_2
python3-ipalib
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
 before 0:4.13.4-1.el10_2
0:4.13.4-1.el10_2
python3-ipaserver
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
 before 0:4.13.4-1.el10_2
0:4.13.4-1.el10_2
python3-ipatests
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
 before 0:4.13.4-1.el10_2
0:4.13.4-1.el10_2
ipa
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 8 CVEs
 before 0:4.12.2-15.el10_0.7
0:4.12.2-15.el10_0.7
ipa-client
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 8 CVEs
 before 0:4.12.2-15.el10_0.7
0:4.12.2-15.el10_0.7
ipa-client-common
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 8 CVEs
 before 0:4.12.2-15.el10_0.7
0:4.12.2-15.el10_0.7
ipa-client-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 8 CVEs
 before 0:4.12.2-15.el10_0.7
0:4.12.2-15.el10_0.7
ipa-client-encrypted-dns
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 8 CVEs
 before 0:4.12.2-15.el10_0.7
0:4.12.2-15.el10_0.7
ipa-client-epn
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 8 CVEs
 before 0:4.12.2-15.el10_0.7
0:4.12.2-15.el10_0.7
ipa-client-samba
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 8 CVEs
 before 0:4.12.2-15.el10_0.7
0:4.12.2-15.el10_0.7
ipa-common
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 8 CVEs
 before 0:4.12.2-15.el10_0.7
0:4.12.2-15.el10_0.7
ipa-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 8 CVEs
 before 0:4.12.2-15.el10_0.7
0:4.12.2-15.el10_0.7
ipa-debugsource
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 8 CVEs
 before 0:4.12.2-15.el10_0.7
0:4.12.2-15.el10_0.7
ipa-selinux
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 8 CVEs
 before 0:4.12.2-15.el10_0.7
0:4.12.2-15.el10_0.7
ipa-selinux-luna
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 8 CVEs
 before 0:4.12.2-15.el10_0.7
0:4.12.2-15.el10_0.7
ipa-selinux-nfast
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 8 CVEs
 before 0:4.12.2-15.el10_0.7
0:4.12.2-15.el10_0.7
ipa-server
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 8 CVEs
 before 0:4.12.2-15.el10_0.7
0:4.12.2-15.el10_0.7
ipa-server-common
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 8 CVEs
 before 0:4.12.2-15.el10_0.7
0:4.12.2-15.el10_0.7
ipa-server-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 8 CVEs
 before 0:4.12.2-15.el10_0.7
0:4.12.2-15.el10_0.7
ipa-server-dns
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 8 CVEs
 before 0:4.12.2-15.el10_0.7
0:4.12.2-15.el10_0.7
ipa-server-encrypted-dns
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 8 CVEs
 before 0:4.12.2-15.el10_0.7
0:4.12.2-15.el10_0.7
ipa-server-trust-ad
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 8 CVEs
 before 0:4.12.2-15.el10_0.7
0:4.12.2-15.el10_0.7
ipa-server-trust-ad-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 8 CVEs
 before 0:4.12.2-15.el10_0.7
0:4.12.2-15.el10_0.7
python3-ipaclient
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 8 CVEs
 before 0:4.12.2-15.el10_0.7
0:4.12.2-15.el10_0.7
python3-ipalib
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 8 CVEs
 before 0:4.12.2-15.el10_0.7
0:4.12.2-15.el10_0.7
python3-ipaserver
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 8 CVEs
 before 0:4.12.2-15.el10_0.7
0:4.12.2-15.el10_0.7
python3-ipatests
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 8 CVEs
 before 0:4.12.2-15.el10_0.7
0:4.12.2-15.el10_0.7
ipa
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 8 CVEs
 before 0:4.12.2-14.el9_6.8
0:4.12.2-14.el9_6.8
ipa-client
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 8 CVEs
 before 0:4.12.2-14.el9_6.8
0:4.12.2-14.el9_6.8
ipa-client-common
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 8 CVEs
 before 0:4.12.2-14.el9_6.8
0:4.12.2-14.el9_6.8
ipa-client-debuginfo
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 8 CVEs
 before 0:4.12.2-14.el9_6.8
0:4.12.2-14.el9_6.8
ipa-client-encrypted-dns
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 8 CVEs
 before 0:4.12.2-14.el9_6.8
0:4.12.2-14.el9_6.8
ipa-client-epn
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 8 CVEs
 before 0:4.12.2-14.el9_6.8
0:4.12.2-14.el9_6.8
ipa-client-samba
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 8 CVEs
 before 0:4.12.2-14.el9_6.8
0:4.12.2-14.el9_6.8
ipa-common
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 8 CVEs
 before 0:4.12.2-14.el9_6.8
0:4.12.2-14.el9_6.8
ipa-debuginfo
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 8 CVEs
 before 0:4.12.2-14.el9_6.8
0:4.12.2-14.el9_6.8
ipa-debugsource
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 8 CVEs
 before 0:4.12.2-14.el9_6.8
0:4.12.2-14.el9_6.8
ipa-selinux
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 8 CVEs
 before 0:4.12.2-14.el9_6.8
0:4.12.2-14.el9_6.8
ipa-selinux-luna
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 8 CVEs
 before 0:4.12.2-14.el9_6.8
0:4.12.2-14.el9_6.8
ipa-selinux-nfast
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 8 CVEs
 before 0:4.12.2-14.el9_6.8
0:4.12.2-14.el9_6.8
ipa-server
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 8 CVEs
 before 0:4.12.2-14.el9_6.8
0:4.12.2-14.el9_6.8
ipa-server-common
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 8 CVEs
 before 0:4.12.2-14.el9_6.8
0:4.12.2-14.el9_6.8
ipa-server-debuginfo
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 8 CVEs
 before 0:4.12.2-14.el9_6.8
0:4.12.2-14.el9_6.8
ipa-server-dns
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 8 CVEs
 before 0:4.12.2-14.el9_6.8
0:4.12.2-14.el9_6.8
ipa-server-encrypted-dns
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 8 CVEs
 before 0:4.12.2-14.el9_6.8
0:4.12.2-14.el9_6.8
ipa-server-trust-ad
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 8 CVEs
 before 0:4.12.2-14.el9_6.8
0:4.12.2-14.el9_6.8
ipa-server-trust-ad-debuginfo
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 8 CVEs
 before 0:4.12.2-14.el9_6.8
0:4.12.2-14.el9_6.8
python3-ipaclient
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 8 CVEs
 before 0:4.12.2-14.el9_6.8
0:4.12.2-14.el9_6.8
python3-ipalib
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 8 CVEs
 before 0:4.12.2-14.el9_6.8
0:4.12.2-14.el9_6.8
python3-ipaserver
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 8 CVEs
 before 0:4.12.2-14.el9_6.8
0:4.12.2-14.el9_6.8
python3-ipatests
Red Hat:rhel_eus:9.6::crb
From an advisory covering 8 CVEs
 before 0:4.12.2-14.el9_6.8
0:4.12.2-14.el9_6.8
ipa
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 8 CVEs
 before 0:4.11.0-15.el9_4.9
0:4.11.0-15.el9_4.9
ipa-client
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 8 CVEs
 before 0:4.11.0-15.el9_4.9
0:4.11.0-15.el9_4.9
ipa-client-common
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 8 CVEs
 before 0:4.11.0-15.el9_4.9
0:4.11.0-15.el9_4.9
ipa-client-debuginfo
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 8 CVEs
 before 0:4.11.0-15.el9_4.9
0:4.11.0-15.el9_4.9
ipa-client-epn
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 8 CVEs
 before 0:4.11.0-15.el9_4.9
0:4.11.0-15.el9_4.9
ipa-client-samba
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 8 CVEs
 before 0:4.11.0-15.el9_4.9
0:4.11.0-15.el9_4.9
ipa-common
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 8 CVEs
 before 0:4.11.0-15.el9_4.9
0:4.11.0-15.el9_4.9
ipa-debuginfo
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 8 CVEs
 before 0:4.11.0-15.el9_4.9
0:4.11.0-15.el9_4.9
ipa-debugsource
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 8 CVEs
 before 0:4.11.0-15.el9_4.9
0:4.11.0-15.el9_4.9
ipa-selinux
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 8 CVEs
 before 0:4.11.0-15.el9_4.9
0:4.11.0-15.el9_4.9
ipa-server
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 8 CVEs
 before 0:4.11.0-15.el9_4.9
0:4.11.0-15.el9_4.9
ipa-server-common
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 8 CVEs
 before 0:4.11.0-15.el9_4.9
0:4.11.0-15.el9_4.9
ipa-server-debuginfo
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 8 CVEs
 before 0:4.11.0-15.el9_4.9
0:4.11.0-15.el9_4.9
ipa-server-dns
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 8 CVEs
 before 0:4.11.0-15.el9_4.9
0:4.11.0-15.el9_4.9
ipa-server-trust-ad
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 8 CVEs
 before 0:4.11.0-15.el9_4.9
0:4.11.0-15.el9_4.9
ipa-server-trust-ad-debuginfo
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 8 CVEs
 before 0:4.11.0-15.el9_4.9
0:4.11.0-15.el9_4.9
python3-ipaclient
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 8 CVEs
 before 0:4.11.0-15.el9_4.9
0:4.11.0-15.el9_4.9
python3-ipalib
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 8 CVEs
 before 0:4.11.0-15.el9_4.9
0:4.11.0-15.el9_4.9
python3-ipaserver
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 8 CVEs
 before 0:4.11.0-15.el9_4.9
0:4.11.0-15.el9_4.9
ipa
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 8 CVEs
 before 0:4.10.1-12.el9_2.7
0:4.10.1-12.el9_2.7
ipa-client
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 8 CVEs
 before 0:4.10.1-12.el9_2.7
0:4.10.1-12.el9_2.7
ipa-client-common
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 8 CVEs
 before 0:4.10.1-12.el9_2.7
0:4.10.1-12.el9_2.7
ipa-client-debuginfo
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 8 CVEs
 before 0:4.10.1-12.el9_2.7
0:4.10.1-12.el9_2.7
ipa-client-epn
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 8 CVEs
 before 0:4.10.1-12.el9_2.7
0:4.10.1-12.el9_2.7
ipa-client-samba
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 8 CVEs
 before 0:4.10.1-12.el9_2.7
0:4.10.1-12.el9_2.7
ipa-common
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 8 CVEs
 before 0:4.10.1-12.el9_2.7
0:4.10.1-12.el9_2.7
ipa-debuginfo
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 8 CVEs
 before 0:4.10.1-12.el9_2.7
0:4.10.1-12.el9_2.7
ipa-debugsource
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 8 CVEs
 before 0:4.10.1-12.el9_2.7
0:4.10.1-12.el9_2.7
ipa-selinux
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 8 CVEs
 before 0:4.10.1-12.el9_2.7
0:4.10.1-12.el9_2.7
ipa-server
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 8 CVEs
 before 0:4.10.1-12.el9_2.7
0:4.10.1-12.el9_2.7
ipa-server-common
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 8 CVEs
 before 0:4.10.1-12.el9_2.7
0:4.10.1-12.el9_2.7
ipa-server-debuginfo
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 8 CVEs
 before 0:4.10.1-12.el9_2.7
0:4.10.1-12.el9_2.7
ipa-server-dns
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 8 CVEs
 before 0:4.10.1-12.el9_2.7
0:4.10.1-12.el9_2.7
ipa-server-trust-ad
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 8 CVEs
 before 0:4.10.1-12.el9_2.7
0:4.10.1-12.el9_2.7
ipa-server-trust-ad-debuginfo
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 8 CVEs
 before 0:4.10.1-12.el9_2.7
0:4.10.1-12.el9_2.7
python3-ipaclient
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 8 CVEs
 before 0:4.10.1-12.el9_2.7
0:4.10.1-12.el9_2.7
python3-ipalib
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 8 CVEs
 before 0:4.10.1-12.el9_2.7
0:4.10.1-12.el9_2.7
python3-ipaserver
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 8 CVEs
 before 0:4.10.1-12.el9_2.7
0:4.10.1-12.el9_2.7
bind-dyndb-ldap
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:11.6-6.module+el8.10.0+23009+91fb337e
0:11.6-6.module+el8.10.0+23009+91fb337e
bind-dyndb-ldap-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:11.6-6.module+el8.10.0+23009+91fb337e
0:11.6-6.module+el8.10.0+23009+91fb337e
bind-dyndb-ldap-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:11.6-6.module+el8.10.0+23009+91fb337e
0:11.6-6.module+el8.10.0+23009+91fb337e
custodia
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:0.6.0-3.module+el8.9.0+18911+94941f82
0:0.6.0-3.module+el8.9.0+18911+94941f82
ipa
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:4.9.13-21.module+el8.10.0+25042+a3bddcd5.3
0:4.9.13-21.module+el8.10.0+25042+a3bddcd5.3
ipa-client
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:4.9.13-21.module+el8.10.0+25042+a3bddcd5.3
0:4.9.13-21.module+el8.10.0+25042+a3bddcd5.3
ipa-client-common
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:4.9.13-21.module+el8.10.0+25042+a3bddcd5.3
0:4.9.13-21.module+el8.10.0+25042+a3bddcd5.3
ipa-client-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:4.9.13-21.module+el8.10.0+25042+a3bddcd5.3
0:4.9.13-21.module+el8.10.0+25042+a3bddcd5.3
ipa-client-epn
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:4.9.13-21.module+el8.10.0+25042+a3bddcd5.3
0:4.9.13-21.module+el8.10.0+25042+a3bddcd5.3
ipa-client-samba
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:4.9.13-21.module+el8.10.0+25042+a3bddcd5.3
0:4.9.13-21.module+el8.10.0+25042+a3bddcd5.3
ipa-common
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:4.9.13-21.module+el8.10.0+25042+a3bddcd5.3
0:4.9.13-21.module+el8.10.0+25042+a3bddcd5.3
ipa-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:4.9.13-21.module+el8.10.0+25042+a3bddcd5.3
0:4.9.13-21.module+el8.10.0+25042+a3bddcd5.3
ipa-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:4.9.13-21.module+el8.10.0+25042+a3bddcd5.3
0:4.9.13-21.module+el8.10.0+25042+a3bddcd5.3
ipa-healthcheck
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:0.12-6.module+el8.10.0+23404+f6b3454f
0:0.12-6.module+el8.10.0+23404+f6b3454f
ipa-healthcheck-core
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:0.12-6.module+el8.10.0+23404+f6b3454f
0:0.12-6.module+el8.10.0+23404+f6b3454f
ipa-python-compat
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:4.9.13-21.module+el8.10.0+25042+a3bddcd5.3
0:4.9.13-21.module+el8.10.0+25042+a3bddcd5.3
ipa-selinux
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:4.9.13-21.module+el8.10.0+25042+a3bddcd5.3
0:4.9.13-21.module+el8.10.0+25042+a3bddcd5.3
ipa-server
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:4.9.13-21.module+el8.10.0+25041+701625f4.3
0:4.9.13-21.module+el8.10.0+25041+701625f4.3
ipa-server-common
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:4.9.13-21.module+el8.10.0+25041+701625f4.3
0:4.9.13-21.module+el8.10.0+25041+701625f4.3
ipa-server-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:4.9.13-21.module+el8.10.0+25041+701625f4.3
0:4.9.13-21.module+el8.10.0+25041+701625f4.3
ipa-server-dns
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:4.9.13-21.module+el8.10.0+25041+701625f4.3
0:4.9.13-21.module+el8.10.0+25041+701625f4.3
ipa-server-trust-ad
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:4.9.13-21.module+el8.10.0+25041+701625f4.3
0:4.9.13-21.module+el8.10.0+25041+701625f4.3
ipa-server-trust-ad-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:4.9.13-21.module+el8.10.0+25041+701625f4.3
0:4.9.13-21.module+el8.10.0+25041+701625f4.3
opendnssec
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:2.1.7-2.module+el8.10.0+22913+7aa1a207
0:2.1.7-2.module+el8.10.0+22913+7aa1a207
opendnssec-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:2.1.7-2.module+el8.10.0+22913+7aa1a207
0:2.1.7-2.module+el8.10.0+22913+7aa1a207
opendnssec-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:2.1.7-2.module+el8.10.0+22913+7aa1a207
0:2.1.7-2.module+el8.10.0+22913+7aa1a207
python-jwcrypto
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:0.5.0-2.module+el8.10.0+21692+c9b201bc
0:0.5.0-2.module+el8.10.0+21692+c9b201bc
python-kdcproxy
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:0.4-5.module+el8.10.0+23610+7d6e87e5.2
0:0.4-5.module+el8.10.0+23610+7d6e87e5.2
python-qrcode
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:5.3-1.module+el8.10.0+22544+6a7f07c2
0:5.3-1.module+el8.10.0+22544+6a7f07c2
python-yubico
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:1.3.2-9.1.module+el8.9.0+18920+2223d05e
0:1.3.2-9.1.module+el8.9.0+18920+2223d05e
python3-custodia
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:0.6.0-3.module+el8.9.0+18911+94941f82
0:0.6.0-3.module+el8.9.0+18911+94941f82
ipa
Rocky Linux:9
From an advisory covering 8 CVEs
 before 0:4.13.4-1.el9_8
0:4.13.4-1.el9_8
ipa
Rocky Linux:10
From an advisory covering 8 CVEs
 before 0:4.13.4-1.el10_2
0:4.13.4-1.el10_2
bind-dyndb-ldap
Rocky Linux:8
From an advisory covering 8 CVEs
 before 0:11.6-6.module+el8.10.0+1960+1ed527b3
0:11.6-6.module+el8.10.0+1960+1ed527b3
custodia
Rocky Linux:8
From an advisory covering 8 CVEs
 before 0:0.6.0-3.module+el8.9.0+1371+ffa84eb9
0:0.6.0-3.module+el8.9.0+1371+ffa84eb9
ipa
Rocky Linux:8
From an advisory covering 8 CVEs
 before 0:4.9.13-21.module+el8.10.0+40089+03bf3c1f
0:4.9.13-21.module+el8.10.0+40089+03bf3c1f
ipa
Rocky Linux:8
From an advisory covering 8 CVEs
 before 0:4.9.13-21.module+el8.10.0+40090+e6f37a74
0:4.9.13-21.module+el8.10.0+40090+e6f37a74
ipa-healthcheck
Rocky Linux:8
From an advisory covering 8 CVEs
 before 0:0.12-6.module+el8.10.0+2053+a0a9dc19
0:0.12-6.module+el8.10.0+2053+a0a9dc19
ipa-healthcheck
Rocky Linux:8
From an advisory covering 8 CVEs
 before 0:0.12-6.module+el8.10.0+2054+aa003774
0:0.12-6.module+el8.10.0+2054+aa003774
opendnssec
Rocky Linux:8
From an advisory covering 8 CVEs
 before 0:2.1.7-2.module+el8.10.0+1960+1ed527b3
0:2.1.7-2.module+el8.10.0+1960+1ed527b3
python-jwcrypto
Rocky Linux:8
From an advisory covering 8 CVEs
 before 0:0.5.0-2.module+el8.10.0+1818+2dfda7a6
0:0.5.0-2.module+el8.10.0+1818+2dfda7a6
python-jwcrypto
Rocky Linux:8
From an advisory covering 8 CVEs
 before 0:0.5.0-2.module+el8.10.0+1819+0aeba2f1
0:0.5.0-2.module+el8.10.0+1819+0aeba2f1
python-kdcproxy
Rocky Linux:8
From an advisory covering 8 CVEs
 before 0:0.4-5.module+el8.9.0+1371+ffa84eb9
0:0.4-5.module+el8.9.0+1371+ffa84eb9
python-kdcproxy
Rocky Linux:8
From an advisory covering 8 CVEs
 before 0:0.4-5.module+el8.10.0+1915+3c70f7d9.1
0:0.4-5.module+el8.10.0+1915+3c70f7d9.1
python-kdcproxy
Rocky Linux:8
From an advisory covering 8 CVEs
 before 0:0.4-5.module+el8.10.0+2094+d7886766.2
0:0.4-5.module+el8.10.0+2094+d7886766.2
python-qrcode
Rocky Linux:8
From an advisory covering 8 CVEs
 before 0:5.3-1.module+el8.10.0+1915+3c70f7d9
0:5.3-1.module+el8.10.0+1915+3c70f7d9
python-qrcode
Rocky Linux:8
From an advisory covering 8 CVEs
 before 0:5.3-1.module+el8.10.0+1916+6bb8cf6b
0:5.3-1.module+el8.10.0+1916+6bb8cf6b
python-yubico
Rocky Linux:8
From an advisory covering 8 CVEs
 before 0:1.3.2-9.1.module+el8.9.0+1371+ffa84eb9
0:1.3.2-9.1.module+el8.9.0+1371+ffa84eb9
python-yubico
Rocky Linux:8
From an advisory covering 8 CVEs
 before 0:1.3.2-9.1.module+el8.9.0+1372+09f67869
0:1.3.2-9.1.module+el8.9.0+1372+09f67869
pyusb
Rocky Linux:8
From an advisory covering 8 CVEs
 before 0:1.0.0-9.1.module+el8.9.0+1372+09f67869
0:1.0.0-9.1.module+el8.9.0+1372+09f67869
pyusb
Rocky Linux:8
From an advisory covering 8 CVEs
 before 0:1.0.0-9.1.module+el8.9.0+1371+ffa84eb9
0:1.0.0-9.1.module+el8.9.0+1371+ffa84eb9
slapi-nis
Rocky Linux:8
From an advisory covering 8 CVEs
 before 0:0.60.0-4.module+el8.9.0+1573+39ab85f4
0:0.60.0-4.module+el8.9.0+1573+39ab85f4
softhsm
Rocky Linux:8
From an advisory covering 8 CVEs
 before 0:2.6.0-5.module+el8.9.0+1371+ffa84eb9
0:2.6.0-5.module+el8.9.0+1371+ffa84eb9
freeipa
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
3.2.1-0ubuntu13.3.4-0ubuntu13.3.4-0ubuntu23.3.4-0ubuntu33.3.4-0ubuntu3.13.3.4-0ubuntu3.1+esm1
 None known
freeipa
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
4.1.4-14.3.1-0ubuntu14.3.1-0ubuntu1+esm1
 None known
freeipa
Ubuntu:18.04:LTS
 All versions, plus listed versions
4.4.4-3ubuntu14.4.4-44.7.0~pre1+git20180411-2ubuntu14.7.0~pre1+git20180411-2ubuntu2
 None known
freeipa
Ubuntu:20.04:LTS
 All versions, plus listed versions
4.8.1-2ubuntu14.8.3-14.8.6-1ubuntu2
 None known
freeipa
Ubuntu:22.04:LTS
 All versions, plus listed versions
4.8.6-1ubuntu64.8.6-1ubuntu84.8.6-1ubuntu94.9.8-1
 None known
freeipa
Ubuntu:24.04:LTS
 All versions, plus listed versions
4.10.2-14.10.2-24.10.2-2ubuntu34.11.1-14.11.1-2
 None known
freeipa
Ubuntu:26.10
 All versions, plus listed versions
4.13.1-14.13.1-1build1
 None known
freeipa
Ubuntu:26.04:LTS
 All versions, plus listed versions
4.12.4-14.12.4-24.13.1-1
 None known

History

History
RecordedChangedSources
affectedOSV
affected, factsEUVD, NVD, OSV
factsCVE List
referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-11861 is a critical vulnerability (CVSS 9.6) in Freeipa, published August 20, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.36%, the 30th percentile. No source names a fixed version.

References

Show 69 moreShow less
This page doesn't list everything

Left out here: 116 package rows. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open