Description
A vulnerability was found in ipa before 4.4. IdM's ca-del, ca-disable, and ca-enable commands did not properly check the user's permissions while modifying CAs in Dogtag. An authenticated, unauthorized attacker could use this flaw to delete, disable, or enable CAs causing various denial of service problems with certificate issuance, OCSP signing, and deletion of secret keys.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | ipa | 4.4 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | ipa +12 | 4.4.0-14.el7_3.6 | RHSA-2017:0388 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | ipa-client +11 | 4.4.0-14.0.1.el7_3.6 | ELSA-2017-0388 |
Advisories 2
- RHSA-2017:0388 Red Hat Security Advisory: ipa security and bug fix update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- ELSA-2017-0388 Moderate: ipa security and bug fix update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Mar 2, 2017
References
- 96557 vdb-entry
- RHSA-2017:0388 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2590