CVE-2019-10195 — FreeIPA logs passwords embedded in commands in calls using batch

Description

A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way that FreeIPA's batch processing API logged operations. This included passing user passwords in clear text on FreeIPA masters. Batch processing of commands with passwords as arguments or options is not performed by default in FreeIPA but is possible by third-party components. An attacker having access to system logs on FreeIPA masters could use this flaw to produce log file content with passwords exposed.

Affected products

Vendor	Product	Affected	Fixed
Red Hat	IPA	all IPA 4.6.x versions before 4.6.7, all IPA 4.7.x versions before 4.7.4, all IPa 4.8.x versions before 4.8.3	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	freeipa	4.8.3-1	—
Debian 13	freeipa	4.8.3-1	—
Debian 12	freeipa	4.8.3-1	—

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 22.04 LTS	freeipa	No fix yet	—
Ubuntu 20.04 LTS	freeipa	No fix yet	—
Ubuntu 18.04 LTS	freeipa	No fix yet	—

Show 2 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu Pro 16.04 LTS	freeipa	No fix yet	—
Ubuntu Pro 14.04 LTS	freeipa	No fix yet	—

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 8	bind-dyndb-ldap	11.1-14.module+el8.1.0+4098+f286395e	RHBA-2019:4268
RHEL 8	custodia +1	0.6.0-3.module+el8.1.0+4098+f286395e	RHBA-2019:4268
RHEL 8	ipa +12	4.8.0-13.module+el8.1.0+4923+c6efe041	RHBA-2019:4268
RHEL 8	ipa-healthcheck	0.3-4.module+el8.1.0+4098+f286395e	RHBA-2019:4268
RHEL 8	ipa-idoverride-memberof +1	0.0.4-6.module+el8.1.0+4098+f286395e	RHBA-2019:4268
RHEL 8	opendnssec	1.4.14-1.module+el8.1.0+4098+f286395e	RHBA-2019:4268
RHEL 8	python-jwcrypto +1	0.5.0-1.module+el8.1.0+4098+f286395e	RHBA-2019:4268
RHEL 8	python-kdcproxy +1	0.4-3.module+el8.1.0+4098+f286395e	RHBA-2019:4268
RHEL 8	python-qrcode +2	5.1-12.module+el8.1.0+4098+f286395e	RHBA-2019:4268
RHEL 8	python-yubico +1	1.3.2-9.module+el8.1.0+4098+f286395e	RHBA-2019:4268
RHEL 8	pyusb +1	1.0.0-9.module+el8.1.0+4098+f286395e	RHBA-2019:4268
RHEL 8	slapi-nis	0.56.3-2.module+el8.1.0+4098+f286395e	RHBA-2019:4268
RHEL 8	softhsm +1	2.4.0-2.module+el8.1.0+4098+f286395e	RHBA-2019:4268
RHEL 7	ipa +11	4.6.5-11.el7_7.4	RHSA-2020:0378

Show 1 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
RHEL 8.0 E4S	bind-dyndb-ldap	11.1-13.module+el8+2555+b334d87b	RHSA-2020:1269
RHEL 8.0 E4S	custodia +1	0.6.0-2.module+el8+2555+b334d87b	RHSA-2020:1269
RHEL 8.0 E4S	ipa +11	4.7.1-12.module+el8.0.0+5776+863ecd37	RHSA-2020:1269
RHEL 8.0 E4S	ipa-idoverride-memberof +1	0.0.4-6.module+el8+2555+b334d87b	RHSA-2020:1269
RHEL 8.0 E4S	opendnssec	1.4.14-1.module+el8+2555+b334d87b	RHSA-2020:1269
RHEL 8.0 E4S	python-jwcrypto +1	0.5.0-1.module+el8+2555+b334d87b	RHSA-2020:1269
RHEL 8.0 E4S	python-kdcproxy +1	0.4-3.module+el8+2555+b334d87b	RHSA-2020:1269
RHEL 8.0 E4S	python-qrcode +2	5.1-11.module+el8+2555+b334d87b	RHSA-2020:1269
RHEL 8.0 E4S	python-yubico +1	1.3.2-9.module+el8+2555+b334d87b	RHSA-2020:1269
RHEL 8.0 E4S	pyusb +1	1.0.0-9.module+el8+2555+b334d87b	RHSA-2020:1269
RHEL 8.0 E4S	slapi-nis	0.56.2-7.module+el8+2555+b334d87b	RHSA-2020:1269
RHEL 8.0 E4S	softhsm +1	2.4.0-2.module+el8+2555+b334d87b	RHSA-2020:1269

AlmaLinux

Errata ↗

Release	Package	Fixed in	Advisory
AlmaLinux 8	custodia +1	0.6.0-3.module_el8.5.0+2603+92118e57	ALBA-2019:4268
AlmaLinux 8	python3-jwcrypto	0.5.0-1.module_el8.5.0+2603+92118e57	ALBA-2019:4268
AlmaLinux 8	python3-pyusb	1.0.0-9.module_el8.5.0+2603+92118e57	ALBA-2019:4268
AlmaLinux 8	python3-qrcode +1	5.1-12.module_el8.5.0+2603+92118e57	ALBA-2019:4268
AlmaLinux 8	python3-yubico	1.3.2-9.module_el8.5.0+2603+92118e57	ALBA-2019:4268

Amazon Linux

Release	Package	Fixed in	Advisory
Amazon Linux 2	ipa-client +10	4.6.5-11.amzn2.4.7	ALAS2-2020-1423

Oracle Linux

Release	Package	Fixed in	Advisory
Oracle Linux 7	ipa-client +10	4.6.5-11.0.1.el7_7.4	ELSA-2020-0378

Affected packages

Ecosystem	Package	Affected	Fixed	Record
PyPI	freeipa	>= 4.6.0, < 4.6.7	4.6.7	GHSA-w4q7-f34x-vpgc
PyPI	freeipa	>= 4.7.0, < 4.7.4	4.7.4	GHSA-w4q7-f34x-vpgc
PyPI	freeipa	>= 4.8.0, < 4.8.3	4.8.3	GHSA-w4q7-f34x-vpgc
PyPI	freeipa	>= 4.6.1, < 4.6.7 · >= 4.7.0, < 4.7.4 · >= 4.8.0, < 4.8.3	4.6.7, 4.7.4, 4.8.3	PYSEC-2019-22
PyPI	ipa	>= 4.6.0, < 4.6.7	4.6.7	GHSA-w4q7-f34x-vpgc
PyPI	ipa	>= 4.7.0, < 4.7.4	4.7.4	GHSA-w4q7-f34x-vpgc
PyPI	ipa	>= 4.8.0, < 4.8.3	4.8.3	GHSA-w4q7-f34x-vpgc
PyPI	ipa	>= 4.6.0, < 4.6.7 · >= 4.7.0, < 4.7.4 · >= 4.8.0, < 4.8.3	4.6.7, 4.7.4, 4.8.3	PYSEC-2019-168

Advisories 6

ALBA-2019:4268 idm:DL1 bug fix update AlmaLinux Security Advisories · Oct 29, 2026
RHSA-2020:0378 Red Hat Security Advisory: ipa security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
RHSA-2020:1269 Red Hat Security Advisory: idm:DL1 security update Red Hat Security Advisories (RHSA) · Feb 21, 2026
RHBA-2019:4268 Red Hat Bug Fix Advisory: idm:DL1 bug fix update Red Hat Security Advisories (RHSA) · Feb 21, 2026
ALAS2-2020-1423 Important: ipa security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · May 12, 2020
ELSA-2020-0378 Important: ipa security and bug fix update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Feb 5, 2020

References

https://www.freeipa.org/page/Releases/4.7.4
https://www.freeipa.org/page/Releases/4.8.3
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10195
https://www.freeipa.org/page/Releases/4.6.7
FEDORA-2019-8e9093da55 vendor-advisory
FEDORA-2019-c64e1612f5 vendor-advisory
RHSA-2020:0378 vendor-advisory
RHBA-2019:4268 vendor-advisory

CNA	v3.0	5.7
OSV:GHSA	v3.0	5.7