Summary
It was discovered that FreeIPA incorrectly handled certificates. An
attacker could possibly use this issue to cause a denial of service by
revoking arbitrary certificates This issue only affected Ubuntu 16.04 ESM.
(CVE-2016-5404)
It was discovered that FreeIPA incorrectly handled authentication attempts.
An attacker could possibly use this issue to cause a denial of service.
(CVE-2016-7030)
It was discovered that FreeIPA incorrectly handled user's permissions. An
authenticated attacker could possibly use this issue to modify other user's
profiles or other unspecified impact. This issue only affected Ubuntu 16.04
ESM. (CVE-2016-9575)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | freeipa | 3.3.4-0ubuntu3.1+esm1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | freeipa | 4.3.1-0ubuntu1+esm1 |
Vulnerabilities 3
-
Unscored —
The cert_revoke command in FreeIPA does not check for the "revoke certificate" permission, which allows remote authenti…
-
Unscored —
FreeIPA uses a default password policy that locks an account after 5 unsuccessful authentication attempts, which allows…
-
Unscored —
Ipa versions 4.2.x, 4.3.x before 4.3.3 and 4.4.x before 4.4.3 did not properly check the user's permissions while modif…