CVE-2019-14867 — Code injection in FreeIPA

Description

A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way the internal function ber_scanf() was used in some components of the IPA server, which parsed kerberos key data. An unauthenticated attacker who could trigger parsing of the krb principal key could cause the IPA server to crash or in some conditions, cause arbitrary code to be executed on the server hosting the IPA server.

Affected products

Vendor	Product	Affected	Fixed
Red Hat	ipa	all IPA 4.6.x versions before 4.6.7, all IPA 4.7.x versions before 4.7.4, all IPa 4.8.x versions before 4.8.3	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	freeipa	4.8.3-1	—
Debian 13	freeipa	4.8.3-1	—
Debian 12	freeipa	4.8.3-1	—

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 22.04 LTS	freeipa	No fix yet	—
Ubuntu 20.04 LTS	freeipa	No fix yet	—
Ubuntu 18.04 LTS	freeipa	No fix yet	—

Show 2 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu Pro 16.04 LTS	freeipa	No fix yet	—
Ubuntu Pro 14.04 LTS	freeipa	No fix yet	—

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 8	bind-dyndb-ldap	11.1-14.module+el8.1.0+4098+f286395e	RHBA-2019:4268
RHEL 8	custodia +1	0.6.0-3.module+el8.1.0+4098+f286395e	RHBA-2019:4268
RHEL 8	ipa +12	4.8.0-13.module+el8.1.0+4923+c6efe041	RHBA-2019:4268
RHEL 8	ipa-healthcheck	0.3-4.module+el8.1.0+4098+f286395e	RHBA-2019:4268
RHEL 8	ipa-idoverride-memberof +1	0.0.4-6.module+el8.1.0+4098+f286395e	RHBA-2019:4268
RHEL 8	opendnssec	1.4.14-1.module+el8.1.0+4098+f286395e	RHBA-2019:4268
RHEL 8	python-jwcrypto +1	0.5.0-1.module+el8.1.0+4098+f286395e	RHBA-2019:4268
RHEL 8	python-kdcproxy +1	0.4-3.module+el8.1.0+4098+f286395e	RHBA-2019:4268
RHEL 8	python-qrcode +2	5.1-12.module+el8.1.0+4098+f286395e	RHBA-2019:4268
RHEL 8	python-yubico +1	1.3.2-9.module+el8.1.0+4098+f286395e	RHBA-2019:4268
RHEL 8	pyusb +1	1.0.0-9.module+el8.1.0+4098+f286395e	RHBA-2019:4268
RHEL 8	slapi-nis	0.56.3-2.module+el8.1.0+4098+f286395e	RHBA-2019:4268
RHEL 8	softhsm +1	2.4.0-2.module+el8.1.0+4098+f286395e	RHBA-2019:4268
RHEL 7	ipa +11	4.6.5-11.el7_7.4	RHSA-2020:0378

Show 1 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
RHEL 8.0 E4S	bind-dyndb-ldap	11.1-13.module+el8+2555+b334d87b	RHSA-2020:1269
RHEL 8.0 E4S	custodia +1	0.6.0-2.module+el8+2555+b334d87b	RHSA-2020:1269
RHEL 8.0 E4S	ipa +11	4.7.1-12.module+el8.0.0+5776+863ecd37	RHSA-2020:1269
RHEL 8.0 E4S	ipa-idoverride-memberof +1	0.0.4-6.module+el8+2555+b334d87b	RHSA-2020:1269
RHEL 8.0 E4S	opendnssec	1.4.14-1.module+el8+2555+b334d87b	RHSA-2020:1269
RHEL 8.0 E4S	python-jwcrypto +1	0.5.0-1.module+el8+2555+b334d87b	RHSA-2020:1269
RHEL 8.0 E4S	python-kdcproxy +1	0.4-3.module+el8+2555+b334d87b	RHSA-2020:1269
RHEL 8.0 E4S	python-qrcode +2	5.1-11.module+el8+2555+b334d87b	RHSA-2020:1269
RHEL 8.0 E4S	python-yubico +1	1.3.2-9.module+el8+2555+b334d87b	RHSA-2020:1269
RHEL 8.0 E4S	pyusb +1	1.0.0-9.module+el8+2555+b334d87b	RHSA-2020:1269
RHEL 8.0 E4S	slapi-nis	0.56.2-7.module+el8+2555+b334d87b	RHSA-2020:1269
RHEL 8.0 E4S	softhsm +1	2.4.0-2.module+el8+2555+b334d87b	RHSA-2020:1269

AlmaLinux

Errata ↗

Release	Package	Fixed in	Advisory
AlmaLinux 8	custodia +1	0.6.0-3.module_el8.5.0+2603+92118e57	ALBA-2019:4268
AlmaLinux 8	python3-jwcrypto	0.5.0-1.module_el8.5.0+2603+92118e57	ALBA-2019:4268
AlmaLinux 8	python3-pyusb	1.0.0-9.module_el8.5.0+2603+92118e57	ALBA-2019:4268
AlmaLinux 8	python3-qrcode +1	5.1-12.module_el8.5.0+2603+92118e57	ALBA-2019:4268
AlmaLinux 8	python3-yubico	1.3.2-9.module_el8.5.0+2603+92118e57	ALBA-2019:4268

Amazon Linux

Release	Package	Fixed in	Advisory
Amazon Linux 2	ipa-client +10	4.6.5-11.amzn2.4.7	ALAS2-2020-1423

Oracle Linux

Release	Package	Fixed in	Advisory
Oracle Linux 7	ipa-client +10	4.6.5-11.0.1.el7_7.4	ELSA-2020-0378

Affected packages

Ecosystem	Package	Affected	Fixed	Record
PyPI	freeipa	>= 4.6.2, < 4.6.7	4.6.7	GHSA-7hpj-hfcr-5qwm
PyPI	freeipa	>= 4.7.0, < 4.7.4	4.7.4	GHSA-7hpj-hfcr-5qwm
PyPI	freeipa	>= 4.8.0, < 4.8.3	4.8.3	GHSA-7hpj-hfcr-5qwm
PyPI	freeipa	>= 4.6.2, < 4.6.7 · >= 4.7.0, < 4.7.4 · >= 4.8.0, < 4.8.3	4.6.7, 4.7.4, 4.8.3	PYSEC-2026-636
PyPI	ipa	>= 4.6.2, < 4.6.7	4.6.7	GHSA-7hpj-hfcr-5qwm
PyPI	ipa	>= 4.7.0, < 4.7.4	4.7.4	GHSA-7hpj-hfcr-5qwm
PyPI	ipa	>= 4.8.0, < 4.8.3	4.8.3	GHSA-7hpj-hfcr-5qwm
PyPI	ipa	>= 4.6.2, < 4.6.7 · >= 4.7.0, < 4.7.4 · >= 4.8.0, < 4.8.3	4.6.7, 4.7.4, 4.8.3	PYSEC-2019-28

Advisories 6

ALBA-2019:4268 idm:DL1 bug fix update AlmaLinux Security Advisories · Oct 29, 2026
RHSA-2020:0378 Red Hat Security Advisory: ipa security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
RHSA-2020:1269 Red Hat Security Advisory: idm:DL1 security update Red Hat Security Advisories (RHSA) · Feb 21, 2026
RHBA-2019:4268 Red Hat Bug Fix Advisory: idm:DL1 bug fix update Red Hat Security Advisories (RHSA) · Feb 21, 2026
ALAS2-2020-1423 Important: ipa security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · May 12, 2020
ELSA-2020-0378 Important: ipa security and bug fix update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Feb 5, 2020

References

https://www.freeipa.org/page/Releases/4.7.4
https://www.freeipa.org/page/Releases/4.8.3
https://www.freeipa.org/page/Releases/4.6.7
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14867
FEDORA-2019-8e9093da55 vendor-advisory
FEDORA-2019-c64e1612f5 vendor-advisory
RHSA-2020:0378 vendor-advisory
RHBA-2019:4268 vendor-advisory

CNA	v3.0	8.8
OSV:GHSA	v3.1	8.8
OSV:PYSEC	v3.1	8.8
EUVD	v3.0	8.8