Freeipa Ipa vulnerabilities

• freeipa, red hat enterprise linux 10, enterprise linux 10.0 extended update support +14 more +16 more Freeipa: idm: ipa: freeipa: obtaining tgs with impersonating cname through trust relationships CVE-2026-11861 9.6 CriticalAugust 20, 2026
• freeipa, red hat enterprise linux 10, enterprise linux 10.0 extended update support +14 more +16 more Ipa: freeipa: unauthenticated dos in `/ipa/i18n_messages` via unbounded request body read CVE-2026-73198 7.5 HighAugust 20, 2026
• freeipa, red hat enterprise linux 10, enterprise linux 10.0 extended update support +14 more +16 more Ipa: privilege escalation via krbcanonicalname manipulation due to realm-unaware uniqueness enforcement in freeipa ldap datastore CVE-2026-13097 8.7 HighAugust 20, 2026
• freeipa, red hat enterprise linux 10, enterprise linux 6 +4 more +6 more Ipa: freeipa: authenticated dos in `otptoken-add` via unbounded otp key decoding/re-encoding CVE-2026-73196 4.3 MediumAugust 20, 2026
• freeipa, red hat enterprise linux 10, enterprise linux 10.0 extended update support +14 more +16 more Ipa: freeipa: unauthenticated dos in `/ipa/migration/migration.py` via unbounded request body read CVE-2026-73197 7.5 HighAugust 20, 2026
• freeipa, red hat enterprise linux 10, enterprise linux 10.0 extended update support +14 more +16 more Freeipa: ipa: freeipa: trust-fetch-domains uses trust-read aci to gate a privileged ad trust refresh, allowing unauthorized ldap writes CVE-2026-19550 8.2 HighAugust 11, 2026
• freeipa, red hat enterprise linux 6, enterprise linux 7 +4 more +6 more Freeipa: delegation rules allow a proxy service to impersonate any user to access another target service CVE-2024-2698 Fix available 8.8 HighJune 10, 2024
• freeipa, fedoraproject fedora, red hat enterprise linux 6 +32 more +34 more Ipa: invalid csrf protection CVE-2023-5455 Fix available 6.5 MediumJanuary 10, 2024
• red hat ipa, freeipa, redhat enterprise linux +2 more A flaw was found in all ipa versions 4.x.x through 4.8.0. When sending a very long password (>= 1... CVE-2020-1722 Fix available 5.3 MediumApril 27, 2020
• freeipa, red hat ipa, fedoraproject fedora +2 more Code injection in FreeIPA CVE-2019-14867 Fix available 8.8 HighNovember 27, 2019
• freeipa, red hat ipa, fedoraproject fedora +2 more FreeIPA logs passwords embedded in commands in calls using batch CVE-2019-10195 Fix available 5.7 MediumNovember 27, 2019
• ipa, freeipa +1 more ipa 3.0 does not properly check server identity before sending credential containing cookies CVE-2012-5631 8.8 HighNovember 25, 2019
• freeipa, red hat ipa, redhat enterprise linux +2 more A flaw was found in FreeIPA versions 4.5.0 and later. Session cookies were retained in the cache... CVE-2019-14826 5.6 MediumSeptember 17, 2019
• red hat ipa, freeipa, redhat enterprise linux +5 more +7 more A vulnerability was found in ipa before 4.4. IdM's ca-del, ca-disable, and ca-enable commands did... CVE-2017-2590 Fix available 8.1 HighJuly 27, 2018
• freeipa ipa, freeipa +1 more Ipa versions 4.2.x, 4.3.x before 4.3.3 and 4.4.x before 4.4.3 did not properly check the user's... CVE-2016-9575 Fix available 6.3 MediumMarch 13, 2018
• freeipa, freeipa ipa +1 more It was found that FreeIPA 4.2.0 and later could disclose password hashes to users having the ... CVE-2017-12169 7.5 HighJanuary 10, 2018
• freeipa ** DISPUTED ** FreeIPA 4.x with API version 2.213 allows a remote authenticated users to bypass... CVE-2017-11191 Disputed 8.8 HighSeptember 27, 2017
• freeipa ipa-kra-install in FreeIPA before 4.2.2 puts the CA agent certificate and private key in /etc... CVE-2015-5284 9.8 CriticalSeptember 21, 2017
• freeipa FreeIPA might display user data improperly via vectors involving non-printable characters. CVE-2015-5179 7.5 HighSeptember 20, 2017
• freeipa FreeIPA uses a default password policy that locks an account after 5 unsuccessful authentication... CVE-2016-7030 Fix available 7.5 HighAugust 28, 2017
• freeipa FreeIPA 4.4.0 allows remote attackers to request an arbitrary SAN name for services. CVE-2016-5414 7.5 HighJune 27, 2017
• freeipa, fedoraproject fedora, oracle linux +2 more The cert_revoke command in FreeIPA does not check for the "revoke certificate" permission, which... CVE-2016-5404 Fix available 6.5 MediumSeptember 7, 2016
• freeipa, fedoraproject fedora +1 more The get_user_grouplist function in the extdom plug-in in FreeIPA before 4.1.4 does not properly... CVE-2015-1827 5.0 MediumMarch 30, 2015
• freeipa Cross-site scripting (XSS) vulnerability in the Web UI in FreeIPA 4.x before 4.1.2 allows remote... CVE-2014-7850 Fix available 4.3 MediumNovember 28, 2014
• freeipa FreeIPA 4.0.x before 4.0.5 and 4.1.x before 4.1.1, when 2FA is enabled, allows remote attackers... CVE-2014-7828 Fix available 3.5 LowNovember 19, 2014