Red Hat Security Advisory: idm:DL1 security update

Fixed packages 45

Vulnerabilities 2

• High 8.8
  CVE-2019-14867

  Code injection in FreeIPA

  A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way the internal function ber_scanf() was used in some components of the IPA server, which parsed kerberos key data. An unaut…

  Red Hat ipa freeipa freeipa Debian Ubuntu PyPI
  Nov 27, 2019
• Medium 5.7
  CVE-2019-10195

  FreeIPA logs passwords embedded in commands in calls using batch

  A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way that FreeIPA's batch processing API logged operations. This included passing user passwords in clear text on FreeIPA mast…

  Red Hat ipa freeipa freeipa Debian Ubuntu PyPI
  Nov 27, 2019

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1726223
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1766920
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_1269.json
• report
  https://access.redhat.com/security/cve/CVE-2019-10195
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-10195
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-10195
• article
  https://www.freeipa.org/page/Releases/4.6.7
• article
  https://www.freeipa.org/page/Releases/4.7.4
• article
  https://www.freeipa.org/page/Releases/4.8.3
• report
  https://access.redhat.com/security/cve/CVE-2019-14867
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-14867
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-14867