The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-826453ad39 advisory.

  - A flaw was found in FreeIPA. This issue may allow a remote attacker to craft a HTTP request with     parameters that can be interpreted as command arguments to kinit on the FreeIPA server, which can lead to     a denial of service. (CVE-2024-1481)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-2147 advisory.

  - A flaw was found in FreeIPA. This issue may allow a remote attacker to craft a HTTP request with     parameters that can be interpreted as command arguments to kinit on the FreeIPA server, which can lead to     a denial of service. (CVE-2024-1481)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3773 advisory.

  - specially crafted HTTP requests potentially lead to DoS or data exposure [fedora-all] (CVE-2024-1481)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2498 advisory.

  - specially crafted HTTP requests potentially lead to DoS or data exposure [fedora-all] (CVE-2024-1481)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-9fc8015fa9 advisory.

  - A flaw was found in FreeIPA. This issue may allow a remote attacker to craft a HTTP request with     parameters that can be interpreted as command arguments to kinit on the FreeIPA server, which can lead to     a denial of service. (CVE-2024-1481)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2024:3044 advisory.

    * freeipa: specially crafted HTTP requests potentially lead to denial of service (CVE-2024-1481)

Tenable has extracted the preceding description block directly from the Rocky Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-bbfef02415 advisory.

  - A flaw was found in FreeIPA. This issue may allow a remote attacker to craft a HTTP request with     parameters that can be interpreted as command arguments to kinit on the FreeIPA server, which can lead to     a denial of service. (CVE-2024-1481)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-3044 advisory.

    - update to the latest git
      - fix for CVE-2012-3429 has been merged
    - fix CVE-2012-3429
    - update to 1.1.0rc1 (CVE-2012-2134)
    - Fix for CVE-2023-5455       Resolves: RHEL-12578
    - Hardening for CVE-2020-25717
    - Hardening for CVE-2020-25717
    - Hardening for CVE-2020-25717
    - Hardening for CVE-2020-25717
    - Rebase to security release 4.8.3 (CVE-2019-14867, CVE-2019-10195)       Resolves: RHBZ#1767304       Resolves: RHBZ#1776939
    - CVE-2019-14867: Denial of service in IPA server due to wrong use of ber_scanf()       Resolves: RHBZ#1767304
    - CVE-2019-10195: Don't log passwords embedded in commands in calls using batch       Resolves: RHBZ#1776939
    - Resolves: #1413137 CVE-2017-2590 ipa: Insufficient permission check for       ca-del, ca-disable and ca-enable commands
      - ca: correctly authorise ca-del, ca-enable and ca-disable
    - Resolves: #1370493 CVE-2016-7030 ipa: DoS attack against kerberized services       by abusing password policy
      - ipa-kdb: search for password policies globally
    - Resolves: #1370493 CVE-2016-7030 ipa: DoS attack against kerberized services       by abusing password policy
      - password policy: Add explicit default password policy for hosts and         services
    - Resolves: #1395311 CVE-2016-9575 ipa: Insufficient permission check in       certprofile-mod
      - certprofile-mod: correctly authorise config update
    - Resolves: #1351593 CVE-2016-5404 ipa: Insufficient privileges check in       certificate revocation
      - cert-revoke: fix permission check bypass (CVE-2016-5404)
    - Related: #1322691 CVE-2015-5370 CVE-2016-2110 CVE-2016-2111 CVE-2016-2112       CVE-2016-2113 CVE-2016-2114 CVE-2016-2115 CVE-2016-2118 samba: various flaws       [rhel-7.3]
      - Rebuild against newer Samba version
    - Resolves: #1264793 CVE-2015-5284 ipa: ipa-kra-install includes certificate       and private key in world readable file [rhel-7.2]
      - install: fix KRA agent PEM file permissions
    - Resolves: #1202998 CVE-2015-1827 ipa: memory corruption when using       get_user_grouplist() [rhel-7.2]
    - CVE-2015-0283 ipa: slapi-nis: infinite loop in getgrnam_r() and getgrgid_r()       (#1202998)
    - CVE-2014-7850 freeipa: XSS flaw can be used to escalate privileges (#1165774)
    - CVE-2014-7828 freeipa: password not required when OTP in use (#1160877)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:2147 advisory.

    Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization     solution for both traditional and cloud-based enterprise environments.

    Security Fix(es):

    * freeipa: specially crafted HTTP requests potentially lead to denial of service (CVE-2024-1481)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.4 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
191958	Fedora 39 : freeipa (2024-826453ad39)	Nessus	Fedora Local Security Checks	3/12/2024	4/29/2024	medium
195040	Oracle Linux 9 : ipa (ELSA-2024-2147)	Nessus	Oracle Linux Local Security Checks	5/6/2024	5/6/2024	medium
192536	Debian dla-3773 : freeipa-admintools - security update	Nessus	Debian Local Security Checks	3/25/2024	4/11/2024	medium
192211	Amazon Linux 2 : ipa (ALAS-2024-2498)	Nessus	Amazon Linux Local Security Checks	3/18/2024	4/11/2024	medium
194668	Fedora 40 : freeipa (2024-9fc8015fa9)	Nessus	Fedora Local Security Checks	4/29/2024	4/29/2024	medium
200613	Rocky Linux 8 : idm:DL1 (RLSA-2024:3044)	Nessus	Rocky Linux Local Security Checks	6/14/2024	6/14/2024	medium
191956	Fedora 38 : freeipa (2024-bbfef02415)	Nessus	Fedora Local Security Checks	3/12/2024	4/29/2024	medium
197996	Oracle Linux 8 : idm:DL1 (ELSA-2024-3044)	Nessus	Oracle Linux Local Security Checks	5/28/2024	6/10/2024	medium
194806	RHEL 9 : ipa (RHSA-2024:2147)	Nessus	Red Hat Local Security Checks	4/30/2024	6/3/2024	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium

medium

medium

medium