A flaw was found in FreeIPA. This issue may allow a remote attacker to craft a HTTP request with parameters that can be interpreted as command arguments to kinit on the FreeIPA server, which can lead to a denial of service.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-d7b9fbb2a5 advisory.

    Automatic update for freeipa-4.11.1-4.fc41.

    ##### **Changelog**

    ```
    * Wed Feb 21 2024 Rob Crittenden <rcritten@redhat.com> - 4.11.1-4
    - Security release: CVE-2024-1481
    - Resolves: rhbz#2265129

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:3044 advisory.

    Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization     solution for both traditional and cloud-based enterprise environments.

    Security Fix(es):

    * freeipa: specially crafted HTTP requests potentially lead to denial of service (CVE-2024-1481)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.10 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2024:3044 advisory.

    * freeipa: specially crafted HTTP requests potentially lead to denial of service (CVE-2024-1481)

Tenable has extracted the preceding description block directly from the Rocky Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-3044 advisory.

    - update to the latest git
      - fix for CVE-2012-3429 has been merged
    - fix CVE-2012-3429
    - update to 1.1.0rc1 (CVE-2012-2134)
    - Fix for CVE-2023-5455       Resolves: RHEL-12578
    - Hardening for CVE-2020-25717
    - Hardening for CVE-2020-25717
    - Hardening for CVE-2020-25717
    - Hardening for CVE-2020-25717
    - Rebase to security release 4.8.3 (CVE-2019-14867, CVE-2019-10195)       Resolves: RHBZ#1767304       Resolves: RHBZ#1776939
    - CVE-2019-14867: Denial of service in IPA server due to wrong use of ber_scanf()       Resolves: RHBZ#1767304
    - CVE-2019-10195: Don't log passwords embedded in commands in calls using batch       Resolves: RHBZ#1776939
    - Resolves: #1413137 CVE-2017-2590 ipa: Insufficient permission check for       ca-del, ca-disable and ca-enable commands
      - ca: correctly authorise ca-del, ca-enable and ca-disable
    - Resolves: #1370493 CVE-2016-7030 ipa: DoS attack against kerberized services       by abusing password policy
      - ipa-kdb: search for password policies globally
    - Resolves: #1370493 CVE-2016-7030 ipa: DoS attack against kerberized services       by abusing password policy
      - password policy: Add explicit default password policy for hosts and         services
    - Resolves: #1395311 CVE-2016-9575 ipa: Insufficient permission check in       certprofile-mod
      - certprofile-mod: correctly authorise config update
    - Resolves: #1351593 CVE-2016-5404 ipa: Insufficient privileges check in       certificate revocation
      - cert-revoke: fix permission check bypass (CVE-2016-5404)
    - Related: #1322691 CVE-2015-5370 CVE-2016-2110 CVE-2016-2111 CVE-2016-2112       CVE-2016-2113 CVE-2016-2114 CVE-2016-2115 CVE-2016-2118 samba: various flaws       [rhel-7.3]
      - Rebuild against newer Samba version
    - Resolves: #1264793 CVE-2015-5284 ipa: ipa-kra-install includes certificate       and private key in world readable file [rhel-7.2]
      - install: fix KRA agent PEM file permissions
    - Resolves: #1202998 CVE-2015-1827 ipa: memory corruption when using       get_user_grouplist() [rhel-7.2]
    - CVE-2015-0283 ipa: slapi-nis: infinite loop in getgrnam_r() and getgrgid_r()       (#1202998)
    - CVE-2014-7850 freeipa: XSS flaw can be used to escalate privileges (#1165774)
    - CVE-2014-7828 freeipa: password not required when OTP in use (#1160877)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-2147 advisory.

    [4.11.0-9.0.1]
    - Set IPAPLATFORM=rhel when build on Oracle Linux [Orabug: 29516674]
    - Add bind to ipa-server-common Requires [Orabug: 36518596]

    [4.11.0-9]
    - Resolves: RHEL-28258 vault fails on non-fips client if server is in FIPS mode
    - Resolves: RHEL-26154 ipa: freeipa: specially crafted HTTP requests potentially lead to DoS or data     exposure

    [4.11.0-8]
    - Resolves: RHEL-12143 'ipa vault-add is failing with ipa: ERROR: an internal error has occurred in FIPS     mode
    - Resolves: RHEL-25738 ipa-kdb: Cannot determine if PAC generator is available

    [4.11.0-7]
    - Resolves: RHEL-25260 tier-1-upstream-dns-locations failed on RHEL8.8 gating
    - Resolves: RHEL-25738 ipa-kdb: Cannot determine if PAC generator is available
    - Resolves: RHEL-25815 Backport latest test fixes in python3-ipatests

    [4.11.0-6]
    - Resolves: RHEL-23627 IPA stops working if HTTP/... service principal was created before FreeIPA 4.4.0     and never modified
    - Resolves: RHEL-23625 sidgen plugin does not ignore staged users
    - Resolves: RHEL-23621 session cookie can't be read
    - Resolves: RHEL-22372 Gating-DL1 test failure in     test_integration/test_dns_locations.py::TestDNSLocations::()::test_ipa_ca_records
    - Resolves: RHEL-21809 CA less servers are failing to be added in topology segment for domain suffix
    - Resolves: RHEL-17996 Memory leak in IdM's KDC

    [4.11.0-5]
    - Resolves: RHEL-12589 ipa: Invalid CSRF protection
    - Resolves: RHEL-19748 ipa hbac-test did not report that it hit an arbitrary search limit
    - Resolves: RHEL-21059 'DogtagCertsConfigCheck' fails, displaying the error message 'Malformed directive:
    ca.signing.certnickname=caSigningCert cert-pki-ca'
    - Resolves: RHEL-21804 ipa client 4.10.2 - Failed to obtain host TGT
    - Resolves: RHEL-21809 CA less servers are failing to be added in topology segment for domain suffix
    - Resolves: RHEL-21810 ipa-client-install --automount-location does not work
    - Resolves: RHEL-21811 Handle change in behavior of pki-server ca-config-show in pki 11.5.0
    - Resolves: RHEL-21812 Backport latest test fixes in ipa
    - Resolves: RHEL-21813 krb5kdc fails to start when pkinit and otp auth type is enabled in ipa
    - Resolves: RHEL-21815 IPA 389ds plugins need to have better logging and tracing
    - Resolves: RHEL-21937 Make sure a default NetBIOS name is set if not passed in by ADTrust instance     constructor

    [4.11.0-4]
    - Resolves: RHEL-16985 Handle samba 4.19 changes in samba.security.dom_sid()

    [4.11.0-3]
    - Resolves: RHEL-14428 healthcheck reports nsslapd-accesslog-logbuffering is set to 'off'

    [4.11.0-2]
    - Resolves: RHEL-14292 Backport latest test fixes in python3-ipatests
    - Resolves: RHEL-15443 Server install: failure to install with externally signed CA because of timezone     issue
    - Resolves: RHEL-15444 Minimum length parameter in pwpolicy cannot be removed with empty string
    - Resolves: RHEL-14842 Upstream xmlrpc tests are failing in RHEL9.4

    [4.11.0-1]
    - Resolves: RHEL-11652 Rebase ipa to latest 4.11.x version for RHEL 9.4

    [4.10.2-4]
    - Resolves: rhbz#2231847 RHEL 8.8 & 9.2 fails to create AD trust with STIG applied
    - Resolves: rhbz#2232056 Include latest test fixes in python3-ipatests

    [4.10.2-3]
    - Resolves: rhbz#2229712 Delete operation protection for admin user
    - Resolves: rhbz#2227831 Interrupt request processing in ipadb_fill_info3() if connection to 389ds is lost
    - Resolves: rhbz#2227784 libipa_otp_lasttoken plugin memory leak
    - Resolves: rhbz#2224570 Improved error messages are needed when attempting to add a non-existing idp to a     user
    - Resolves: rhbz#2230251 Backport latest test fixes to python3-ipatests

    [4.10.2-2]
    - Resolves: rhbz#2192969 Better handling of the command line and web UI cert search and/or list features
    - Resolves: rhbz#2214933 Uninstalling of the IPA server is encountering a failure during the     unconfiguration of the CA (Unconfiguring CA)
    - Resolves: rhbz#2216114 After updating the RHEL from 8.7 to 8.8, IPA services fails to start
    - Resolves: rhbz#2216549 Upgrade to 4.9.10-6.0.1 fails: attributes are managed by topology plugin
    - Resolves: rhbz#2216611 Backport latest test fixes in python3-ipatests
    - Resolves: rhbz#2216872 User authentication failing on OTP validation using multiple tokens, succeeds     with password only

    [4.10.2-1]
    - Resolves: rhbz#2196426 [Rebase] Rebase ipa to latest 4.10.x release for RHEL 9.3
    - Resolves: rhbz#2192969 Better handling of the command line and web UI cert search and/or list features
    - Resolves: rhbz#2192625 Better catch of the IPA web UI event 'IPA Error 4301:CertificateOperationError',     and IPA httpd error CertificateOperationError
    - Resolves: rhbz#2188567 IPA client Kerberos configuration incompatible with java
    - Resolves: rhbz#2182683 Tolerate absence of PAC ticket signature depending of domain and servers     capabilities [rhel-9]
    - Resolves: rhbz#2180914 Sequence processing failures for group_add using server context
    - Resolves: rhbz#2165880 Add RBCD support to IPA
    - Resolves: rhbz#2160399 get_ranges - [file ipa_sidgen_common.c, line 276]: Failed to convert LDAP entry     to range struct

    [4.10.1-6]
    - Resolves: rhbz#2169632 Backport latest test fixes in python3-ipatests

    [4.10.1-5]
    - Resolves: rhbz#2162656 Passwordless (GSSAPI) SSH not working for subdomain
    - Resolves: rhbz#2166326 Removing the last DNS type for ipa-ca does not work
    - Resolves: rhbz#2167473 RFE - Add a warning note about possible performance impact of the Auto Member     rebuild task
    - Resolves: rhbz#2168244 requestsearchtimelimit=0 doesn't seems to be work with ipa-acme-manage pruning     command

    [4.10.1-4]
    - Resolves: rhbz#2161284 'ERROR Could not remove /tmp/tmpbkw6hawo.ipabkp' can be seen prior to 'ipa-     client-install' command was successful
    - Resolves: rhbz#2164403 ipa-trust-add with --range-type=ipa-ad-trust-posix fails while creating an ID     range
    - Resolves: rhbz#2162677 RFE: Implement support for PKI certificate and request pruning
    - Resolves: rhbz#2167312 - Backport latest test fixes in python3-ipatests

    [4.10.1-3]
    - Rebuild against krb5 1.20.1 ABI
    - Resolves: rhbz#2155425

    [4.10.1-2]
    - Resolves: rhbz#2148887 MemberManager with groups fails
    - Resolves: rhbz#2150335 idm:client is missing dependency on krb5-pkinit

    [4.10.1-1]
    - Resolves: rhbz#2141315 [Rebase] Rebase ipa to latest 4.10.x release for RHEL 9.2
    - Resolves: rhbz#2094673 ipa-client-install should just use system wide CA store and do not specify     TLS_CACERT in ldap.conf
    - Resolves: rhbz#2117167 After leapp upgrade on ipa-client ipa-server package installation failed.
    (REQ_FULL_WITH_MEMBERS returns object from wrong domain)
    - Resolves: rhbz#2127833 Password Policy Grace login limit allows invalid maximum value
    - Resolves: rhbz#2143224 [RFE] add certificate support to ipa-client instead of one time password
    - Resolves: rhbz#2144736 vault interoperability with older RHEL systems is broken
    - Resolves: rhbz#2148258 ipa-client-install does not maintain server affinity during installation
    - Resolves: rhbz#2148379 Add warning for empty targetattr when creating ACI with RBAC
    - Resolves: rhbz#2148380 OTP token sync always returns OK even with random numbers
    - Resolves: rhbz#2148381 Deprecated feature idnssoaserial in IdM appears when creating reverse dns zones
    - Resolves: rhbz#2148382 Introduction of URI records for kerberos breaks location functionality

    [4.10.0-7]
    - Resolves: rhbz#2124547 Attempt to log in as 'root' user with admin's password in Web UI does not     properly fail
    - Resolves: rhbz#2137555 Attempt to log in as 'root' user with admin's password in Web UI does not     properly fail [rhel-9.1.0.z]

    [4.10.0-6]
    - Resolves: rhbz#2110014 ldap bind occurs when admin user changes password with gracelimit=0
    - Resolves: rhbz#2112901 RFE: Allow grace login limit to be set in IPA WebUI
    - Resolves: rhbz#2115495 group password policy by default does not allow grace logins
    - Resolves: rhbz#2116966 ipa-replica-manage displays traceback: Unexpected error: 'bool' object has no     attribute 'lower'

    [4.10.0-5]
    - Resolves: rhbz#2109645
      - Rebuild for samba-4.16.3-101.el9

    [4.10.0-4]
    - Resolves: rhbz#2109645
      - Rebuild for samba-4.16.3-100.el9

    [4.10.0-3]
    - Resolves: rhbz#2105294 IdM WebUI Pagination Size should not allow empty value

    [4.10.0-2]
    - Resolves: rhbz#2091988 [RFE] Add code to check password expiration on ldap bind

    [4.10.0-1]
    - Resolves: rhbz#747959 [RFE] Support random serial numbers in IPA certificates
    - Resolves: rhbz#2100227 [UX] Preserving a user account produces output saying it was deleted

    [4.9.10-1]
    - Resolves: rhbz#2079469 [Rebase] Rebase ipa to latest 4.9.x release
    - Resolves: rhbz#2012911 named journalctl logs shows 'zone testrealm.test/IN: serial (serialnumber) write     back to LDAP failed.'
    - Resolves: rhbz#2069202 [RFE] add support for authenticating against external IdP services using OAUTH2     preauthenticaiton mechanism provided by SSSD
    - Resolves: rhbz#2083218 ipa-dnskeysyncd floods /var/log/messages with DEBUG messages
    - Resolves: rhbz#2089750 RFE: Improve error message with more detail for ipa-replica-install command
    - Resolves: rhbz#2091988 [RFE] Add code to check password expiration on ldap bind
    - Resolves: rhbz#2094400 [RFE] ipa-client-install should provide option to enable subid: sss in     /etc/nsswitch.conf
    - Resolves: rhbz#2096922 secret in ipa-pki-proxy.conf is not changed if new requiredSecret value is     present in /etc/pki/pki-tomcat/server.xml

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:2147 advisory.

    Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization     solution for both traditional and cloud-based enterprise environments.

    Security Fix(es):

    * freeipa: specially crafted HTTP requests potentially lead to denial of service (CVE-2024-1481)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.4 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-9fc8015fa9 advisory.

    Automatic update for freeipa-4.11.1-4.fc40.

    ##### **Changelog**

    ```
    * Wed Feb 21 2024 Rob Crittenden <rcritten@redhat.com> - 4.11.1-4
    - Security release: CVE-2024-1481
    - Resolves: rhbz#2265129

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3773 advisory.

  - specially crafted HTTP requests potentially lead to DoS or data exposure [fedora-all] (CVE-2024-1481)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2498 advisory.

  - specially crafted HTTP requests potentially lead to DoS or data exposure [fedora-all] (CVE-2024-1481)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-826453ad39 advisory.

    - Security release: CVE-2024-1481
    - Resolves: rhbz#2265129

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-bbfef02415 advisory.

    - Security release: CVE-2024-1481
    - Resolves: rhbz#2265129

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
211327	Fedora 41 : freeipa (2024-d7b9fbb2a5)	Nessus	Fedora Local Security Checks	medium
210488	RHEL 8 : idm:DL1 (RHSA-2024:3044)	Nessus	Red Hat Local Security Checks	medium
200613	Rocky Linux 8 : idm:DL1 (RLSA-2024:3044)	Nessus	Rocky Linux Local Security Checks	medium
197996	Oracle Linux 8 : idm:DL1 (ELSA-2024-3044)	Nessus	Oracle Linux Local Security Checks	medium
196270	RHEL 7 : freeipa (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	medium
195040	Oracle Linux 9 : ipa (ELSA-2024-2147)	Nessus	Oracle Linux Local Security Checks	medium
194806	RHEL 9 : ipa (RHSA-2024:2147)	Nessus	Red Hat Local Security Checks	medium
194668	Fedora 40 : freeipa (2024-9fc8015fa9)	Nessus	Fedora Local Security Checks	medium
192536	Debian dla-3773 : freeipa-admintools - security update	Nessus	Debian Local Security Checks	medium
192211	Amazon Linux 2 : ipa (ALAS-2024-2498)	Nessus	Amazon Linux Local Security Checks	medium
191958	Fedora 39 : freeipa (2024-826453ad39)	Nessus	Fedora Local Security Checks	medium
191956	Fedora 38 : freeipa (2024-bbfef02415)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2024-1481

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium