ELSA-2016-1797 — Moderate: ipa security update (Oracle Linux 7)

Summary

[3.0.0-50.el6.2]
- Resolves: #1351593 CVE-2016-5404 ipa: Insufficient privileges check in
certificate revocation
- cert-revoke: fix permission check bypass (CVE-2016-5404)

Fixed packages 7

Release	Package	Fixed in
Oracle Linux · 7	ipa-admintools	0:4.2.0-15.0.1.el7_2.19
Oracle Linux · 7	ipa-client	0:4.2.0-15.0.1.el7_2.19
Oracle Linux · 7	ipa-python	0:4.2.0-15.0.1.el7_2.19
Oracle Linux · 7	ipa-server	0:4.2.0-15.0.1.el7_2.19
Oracle Linux · 7	ipa-server-dns	0:4.2.0-15.0.1.el7_2.19
Oracle Linux · 7	ipa-server-selinux	0:3.0.0-50.el6_8.2
Oracle Linux · 7	ipa-server-trust-ad	0:4.2.0-15.0.1.el7_2.19

Vulnerabilities 1

Unscored —

CVE-2016-5404

The cert_revoke command in FreeIPA does not check for the "revoke certificate" permission, which allows remote authenti…

freeipa freeipa Debian Ubuntu

Sep 7, 2016

Moderate: ipa security update (Oracle Linux 7)

Summary

Fixed packages 7

Vulnerabilities 1

The cert_revoke command in FreeIPA does not check for the "revoke certificate" permission, which allows remote authenti…