Description
A vulnerability was found in FreeIPA in how the initial implementation of MS-SFU by MIT Kerberos was missing a condition for granting the "forwardable" flag on S4U2Self tickets. Fixing this mistake required adding a special case for the check_allowed_to_delegate() function: If the target service argument is NULL, then it means the KDC is probing for general constrained delegation rules and not checking a specific S4U2Proxy request.
In FreeIPA 4.11.0, the behavior of ipadb_match_acl() was modified to match the changes from upstream MIT Kerberos 1.20. However, a mistake resulting in this mechanism applies in cases where the target service argument is set AND where it is unset. This results in S4U2Proxy requests being accepted regardless of whether or not there is a matching service delegation rule.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | freeipa | 4.11.0 – < 4.11.2, 4.12.0 – < 4.12.1 | 4.11.2 |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 9.2 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 6 | — | — |
| Red Hat | Red Hat Enterprise Linux 7 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | freeipa | 4.12.2-1 | — |
| Debian 13 | freeipa | 4.12.2-1 | — |
| Debian 12 | freeipa | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | freeipa | No fix yet | — |
| Ubuntu 26.04 LTS | freeipa | No fix yet | — |
| Ubuntu 25.10 | freeipa | No fix yet | — |
| Ubuntu 24.04 LTS | freeipa | No fix yet | — |
| Ubuntu 22.04 LTS | freeipa | No fix yet | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | freeipa | No fix yet | — |
| Ubuntu 18.04 LTS | freeipa | No fix yet | — |
| Ubuntu Pro 16.04 LTS | freeipa | No fix yet | — |
| Ubuntu Pro 14.04 LTS | freeipa | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | ipa +14 | 4.11.0-15.el9_4 | RHSA-2024:3754 |
| RHEL 8 | bind-dyndb-ldap | 11.6-5.module+el8.10.0+21691+df63127d | RHSA-2024:3755 |
| RHEL 8 | custodia +1 | 0.6.0-3.module+el8.9.0+18911+94941f82 | RHSA-2024:3755 |
| RHEL 8 | ipa +15 | 4.9.13-10.module+el8.10.0+21944+3943ad77 | RHSA-2024:3755 |
| RHEL 8 | ipa-healthcheck +1 | 0.12-3.module+el8.9.0+19634+c162f948 | RHSA-2024:3755 |
| RHEL 8 | opendnssec | 2.1.7-1.module+el8.9.0+18911+94941f82 | RHSA-2024:3755 |
| RHEL 8 | python-jwcrypto +1 | 0.5.0-2.module+el8.10.0+21691+df63127d | RHSA-2024:3755 |
| RHEL 8 | python-kdcproxy +1 | 0.4-5.module+el8.9.0+18911+94941f82 | RHSA-2024:3755 |
| RHEL 8 | python-qrcode +2 | 5.1-12.module+el8.9.0+18911+94941f82 | RHSA-2024:3755 |
| RHEL 8 | python-yubico +1 | 1.3.2-9.1.module+el8.9.0+18911+94941f82 | RHSA-2024:3755 |
| RHEL 8 | pyusb +1 | 1.0.0-9.1.module+el8.9.0+18911+94941f82 | RHSA-2024:3755 |
| RHEL 8 | slapi-nis | 0.60.0-4.module+el8.10.0+20723+03062ebd | RHSA-2024:3755 |
| RHEL 8 | softhsm +1 | 2.6.0-5.module+el8.9.0+18911+94941f82 | RHSA-2024:3755 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.2 EUS | ipa +14 | 4.10.1-12.el9_2.2 | RHSA-2024:3757 |
| RHEL 8.8 EUS | bind-dyndb-ldap | 11.6-4.module+el8.8.0+21675+157fa23b.2 | RHSA-2024:3759 |
| RHEL 8.8 EUS | custodia +1 | 0.6.0-3.module+el8.1.0+4098+f286395e | RHSA-2024:3759 |
| RHEL 8.8 EUS | ipa +15 | 4.9.11-11.module+el8.8.0+21953+5e839de2.1 | RHSA-2024:3759 |
| RHEL 8.8 EUS | ipa-healthcheck +1 | 0.12-1.module+el8.8.0+17582+6bf5bf91 | RHSA-2024:3759 |
| RHEL 8.8 EUS | opendnssec | 2.1.7-1.module+el8.4.0+9007+5084bdd8 | RHSA-2024:3759 |
| RHEL 8.8 EUS | python-jwcrypto +1 | 0.5.0-1.1.module+el8.7.0+15842+306cbc83 | RHSA-2024:3759 |
| RHEL 8.8 EUS | python-kdcproxy +1 | 0.4-5.module+el8.2.0+4691+a05b2456 | RHSA-2024:3759 |
| RHEL 8.8 EUS | python-qrcode +2 | 5.1-12.module+el8.1.0+4098+f286395e | RHSA-2024:3759 |
| RHEL 8.8 EUS | python-yubico +1 | 1.3.2-9.1.module+el8.7.0+15691+2b2c1dd5 | RHSA-2024:3759 |
| RHEL 8.8 EUS | pyusb +1 | 1.0.0-9.1.module+el8.7.0+15691+2b2c1dd5 | RHSA-2024:3759 |
| RHEL 8.8 EUS | slapi-nis | 0.60.0-4.module+el8.8.0+20635+330e3683 | RHSA-2024:3759 |
| RHEL 8.8 EUS | softhsm +1 | 2.6.0-5.module+el8.4.0+10227+076cd560 | RHSA-2024:3759 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | ipa-client +13 | 4.11.0-15.el9_4.alma.1 | ALSA-2024:3754 |
| AlmaLinux 8 | bind-dyndb-ldap | 11.6-5.module_el8.10.0+3844+20e075e5.alma.2 | ALSA-2024:3755 |
| AlmaLinux 8 | custodia +1 | 0.6.0-3.module_el8.6.0+2881+2f24dc92 | ALSA-2024:3755 |
| AlmaLinux 8 | ipa-client +14 | 4.9.13-10.module_el8.10.0+3857+9c8da539 | ALSA-2024:3755 |
| AlmaLinux 8 | ipa-healthcheck +1 | 0.12-3.module_el8.9.0+3651+d05ea4c5 | ALSA-2024:3755 |
| AlmaLinux 8 | opendnssec | 2.1.7-1.module_el8.6.0+2881+2f24dc92 | ALSA-2024:3755 |
| AlmaLinux 8 | python3-jwcrypto | 0.5.0-2.module_el8.10.0+3844+20e075e5 | ALSA-2024:3755 |
| AlmaLinux 8 | python3-kdcproxy | 0.4-5.module_el8.9.0+3785+2238a12a | ALSA-2024:3755 |
| AlmaLinux 8 | python3-pyusb | 1.0.0-9.1.module_el8.7.0+3349+cfeff52e | ALSA-2024:3755 |
| AlmaLinux 8 | python3-qrcode +1 | 5.1-12.module_el8.6.0+2881+2f24dc92 | ALSA-2024:3755 |
| AlmaLinux 8 | python3-yubico | 1.3.2-9.1.module_el8.7.0+3349+cfeff52e | ALSA-2024:3755 |
| AlmaLinux 8 | slapi-nis | 0.60.0-4.module_el8.10.0+3844+20e075e5.alma.1 | ALSA-2024:3755 |
| AlmaLinux 8 | softhsm +1 | 2.6.0-5.module_el8.6.0+2881+2f24dc92 | ALSA-2024:3755 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | ipa | 4.11.0-15.el9_4 | RLSA-2024:3754 |
| Rocky Linux 8 | bind-dyndb-ldap | 11.6-5.module+el8.10.0+1819+0aeba2f1 | RLSA-2024:3755 |
| Rocky Linux 8 | custodia | 0.6.0-3.module+el8.9.0+1371+ffa84eb9 | RLSA-2024:3755 |
| Rocky Linux 8 | ipa | 4.9.13-10.module+el8.10.0+1828+d0e644b0 | RLSA-2024:3755 |
| Rocky Linux 8 | ipa-healthcheck | 0.12-3.module+el8.9.0+1433+5bd2f890 | RLSA-2024:3755 |
| Rocky Linux 8 | opendnssec | 2.1.7-1.module+el8.9.0+1371+ffa84eb9 | RLSA-2024:3755 |
| Rocky Linux 8 | python-jwcrypto | 0.5.0-2.module+el8.10.0+1818+2dfda7a6 | RLSA-2024:3755 |
| Rocky Linux 8 | python-kdcproxy | 0.4-5.module+el8.9.0+1371+ffa84eb9 | RLSA-2024:3755 |
| Rocky Linux 8 | python-qrcode | 5.1-12.module+el8.9.0+1371+ffa84eb9 | RLSA-2024:3755 |
| Rocky Linux 8 | python-yubico | 1.3.2-9.1.module+el8.9.0+1371+ffa84eb9 | RLSA-2024:3755 |
| Rocky Linux 8 | pyusb | 1.0.0-9.1.module+el8.9.0+1371+ffa84eb9 | RLSA-2024:3755 |
| Rocky Linux 8 | slapi-nis | 0.60.0-4.module+el8.9.0+1573+39ab85f4 | RLSA-2024:3755 |
| Rocky Linux 8 | softhsm | 2.6.0-5.module+el8.9.0+1371+ffa84eb9 | RLSA-2024:3755 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | ipa-client +13 | 4.11.0-15.0.1.el9_4 | ELSA-2024-3754 |
| Oracle Linux 8 | bind-dyndb-ldap | 11.6-5.module+el8.10.0+90339+985471f7 | ELSA-2024-3755 |
| Oracle Linux 8 | custodia +1 | 0.6.0-3.module+el8.9.0+90094+20819f5a | ELSA-2024-3755 |
| Oracle Linux 8 | ipa-client +14 | 4.9.13-10.0.1.module+el8.10.0+90350+f6ece971 | ELSA-2024-3755 |
| Oracle Linux 8 | ipa-healthcheck +1 | 0.12-3.module+el8.9.0+90094+20819f5a | ELSA-2024-3755 |
| Oracle Linux 8 | opendnssec | 2.1.7-1.module+el8.9.0+90094+20819f5a | ELSA-2024-3755 |
| Oracle Linux 8 | python3-jwcrypto | 0.5.0-2.module+el8.10.0+90339+985471f7 | ELSA-2024-3755 |
| Oracle Linux 8 | python3-kdcproxy | 0.4-5.module+el8.9.0+90122+3305dc1d | ELSA-2024-3755 |
| Oracle Linux 8 | python3-pyusb | 1.0.0-9.1.module+el8.9.0+90094+20819f5a | ELSA-2024-3755 |
| Oracle Linux 8 | python3-qrcode +1 | 5.1-12.module+el8.9.0+90094+20819f5a | ELSA-2024-3755 |
| Oracle Linux 8 | python3-yubico | 1.3.2-9.1.module+el8.9.0+90094+20819f5a | ELSA-2024-3755 |
| Oracle Linux 8 | slapi-nis | 0.60.0-4.module+el8.10.0+90297+bfe93ccc | ELSA-2024-3755 |
| Oracle Linux 8 | softhsm +1 | 2.6.0-5.module+el8.9.0+90094+20819f5a | ELSA-2024-3755 |
Advisories 11
- ALSA-2024:3754 Important: ipa security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2024:3755 Important: idm:DL1 security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2024:3759 Red Hat Security Advisory: idm:DL1 security update Red Hat Security Advisories (RHSA) · Jul 2, 2026
- RHSA-2024:3757 Red Hat Security Advisory: ipa security update Red Hat Security Advisories (RHSA) · Jul 2, 2026
- RHSA-2024:3755 Red Hat Security Advisory: idm:DL1 security update Red Hat Security Advisories (RHSA) · Jul 2, 2026
- RHSA-2024:3754 Red Hat Security Advisory: ipa security update Red Hat Security Advisories (RHSA) · Jul 2, 2026
- RLSA-2024:3755 Important: idm:DL1 security update Rocky Linux Security Advisories · Feb 5, 2026
- RLSA-2024:3754 Important: ipa security update Rocky Linux Security Advisories · Feb 4, 2026
- WID-SEC-2024-1326 Red Hat Enterprise Linux (FreeIPA): Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 19, 2025
- ELSA-2024-3755 Important: idm:DL1 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jun 11, 2024
- ELSA-2024-3754 Important: ipa security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jun 10, 2024
References
- RHSA-2024:3754 vendor-advisory
- RHSA-2024:3755 vendor-advisory
- RHSA-2024:3757 vendor-advisory
- RHSA-2024:3759 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2024-2698 vdb-entry
- RHBZ#2270353 issue-tracking
- https://www.freeipa.org/release-notes/4-12-1.html