Description
A privilege escalation flaw from host to domain administrator was found in FreeIPA. This vulnerability is similar to CVE-2025-4404, where it fails to validate the uniqueness of the krbCanonicalName. While the previously released version added validations for the admin@REALM credential, FreeIPA still does not validate the root@REALM canonical name, which can also be used as the realm administrator's name. This flaw allows an attacker to perform administrative tasks over the REALM, leading to access to sensitive data and sensitive data exfiltration.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 7 Extended Lifecycle Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 8.2 Advanced Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Telecommunications Update Service | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | — | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.4 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 6 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | freeipa | No fix yet | — |
| Debian 13 | freeipa | No fix yet | — |
| Debian 12 | freeipa | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | freeipa | No fix yet | — |
| Ubuntu 26.04 LTS | freeipa | No fix yet | — |
| Ubuntu 25.10 | freeipa | No fix yet | — |
| Ubuntu 24.04 LTS | freeipa | No fix yet | — |
| Ubuntu 22.04 LTS | freeipa | No fix yet | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | freeipa | No fix yet | — |
| Ubuntu 18.04 LTS | freeipa | No fix yet | — |
| Ubuntu Pro 16.04 LTS | freeipa | No fix yet | — |
| Ubuntu Pro 14.04 LTS | freeipa | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | ipa +18 | 4.12.2-15.el10_0.4 | RHSA-2025:20994, RHSA-2025:17085 |
| RHEL 9 | ipa +18 | 4.12.2-14.el9_6.5 | RHSA-2025:20928, RHSA-2025:17084 |
| RHEL 8 | bind-dyndb-ldap | 11.6-6.module+el8.10.0+23009+91fb337e | RHSA-2025:17129 |
| RHEL 8 | custodia +1 | 0.6.0-3.module+el8.9.0+18911+94941f82 | RHSA-2025:17129 |
| RHEL 8 | ipa +9 | 4.9.13-20.module+el8.10.0+23537+32c82745 | RHSA-2025:17129 |
| RHEL 8 | ipa-healthcheck +1 | 0.12-6.module+el8.10.0+23404+f6b3454f | RHSA-2025:17129 |
| RHEL 8 | ipa-server +5 | 4.9.13-20.module+el8.10.0+23534+744f3864 | RHSA-2025:17129 |
| RHEL 8 | opendnssec | 2.1.7-2.module+el8.10.0+22913+7aa1a207 | RHSA-2025:17129 |
| RHEL 8 | python-jwcrypto +1 | 0.5.0-2.module+el8.10.0+21692+c9b201bc | RHSA-2025:17129 |
| RHEL 8 | python-kdcproxy +1 | 0.4-5.module+el8.10.0+22564+098ba143.1 | RHSA-2025:17129 |
| RHEL 8 | python-qrcode +2 | 5.3-1.module+el8.10.0+22544+6a7f07c2 | RHSA-2025:17129 |
| RHEL 8 | python-yubico +1 | 1.3.2-9.1.module+el8.9.0+18920+2223d05e | RHSA-2025:17129 |
| RHEL 8 | pyusb +1 | 1.0.0-9.1.module+el8.9.0+18920+2223d05e | RHSA-2025:17129 |
| RHEL 8 | slapi-nis | 0.60.0-4.module+el8.10.0+20723+03062ebd | RHSA-2025:17129 |
| RHEL 8 | softhsm +1 | 2.6.0-5.module+el8.9.0+18911+94941f82 | RHSA-2025:17129 |
Show 12 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.4 EUS | ipa +14 | 4.11.0-15.el9_4.7 | RHSA-2025:17088 |
| RHEL 9.2 E4S | ipa +13 | 4.10.1-12.el9_2.6 | RHSA-2025:17087 |
| RHEL 9.0 E4S | ipa +13 | 4.9.8-11.el9_0.5 | RHSA-2025:17086 |
| RHEL 8.8 TUS | bind-dyndb-ldap | 11.6-4.module+el8.8.0+21675+157fa23b.2 | RHSA-2025:17645 |
| RHEL 8.8 TUS | custodia +1 | 0.6.0-3.module+el8.1.0+4098+f286395e | RHSA-2025:17645 |
| RHEL 8.8 TUS | ipa +9 | 4.9.11-11.module+el8.8.0+23533+bee8d442.3 | RHSA-2025:17645 |
| RHEL 8.8 TUS | ipa-healthcheck +1 | 0.12-1.module+el8.8.0+17583+8c783c60 | RHSA-2025:17645 |
| RHEL 8.8 TUS | ipa-server +5 | 4.9.11-11.module+el8.8.0+23530+2673a519.3 | RHSA-2025:17645 |
| RHEL 8.8 TUS | opendnssec | 2.1.7-1.module+el8.4.0+9007+5084bdd8 | RHSA-2025:17645 |
| RHEL 8.8 TUS | python-jwcrypto +1 | 0.5.0-1.1.module+el8.7.0+15888+685a878f | RHSA-2025:17645 |
| RHEL 8.8 TUS | python-kdcproxy +1 | 0.4-5.module+el8.2.0+4691+a05b2456 | RHSA-2025:17645 |
| RHEL 8.8 TUS | python-qrcode +2 | 5.1-12.module+el8.1.0+4107+4a66eb87 | RHSA-2025:17645 |
| RHEL 8.8 TUS | python-yubico +1 | 1.3.2-9.1.module+el8.7.0+15691+2b2c1dd5 | RHSA-2025:17645 |
| RHEL 8.8 TUS | pyusb +1 | 1.0.0-9.1.module+el8.7.0+15691+2b2c1dd5 | RHSA-2025:17645 |
| RHEL 8.8 TUS | slapi-nis | 0.60.0-4.module+el8.8.0+20635+330e3683 | RHSA-2025:17645 |
| RHEL 8.8 TUS | softhsm +1 | 2.6.0-5.module+el8.4.0+10227+076cd560 | RHSA-2025:17645 |
| RHEL 8.8 E4S | bind-dyndb-ldap | 11.6-4.module+el8.8.0+21675+157fa23b.2 | RHSA-2025:17645 |
| RHEL 8.8 E4S | custodia +1 | 0.6.0-3.module+el8.1.0+4098+f286395e | RHSA-2025:17645 |
| RHEL 8.8 E4S | ipa +9 | 4.9.11-11.module+el8.8.0+23533+bee8d442.3 | RHSA-2025:17645 |
| RHEL 8.8 E4S | ipa-healthcheck +1 | 0.12-1.module+el8.8.0+17583+8c783c60 | RHSA-2025:17645 |
| RHEL 8.8 E4S | ipa-server +5 | 4.9.11-11.module+el8.8.0+23530+2673a519.3 | RHSA-2025:17645 |
| RHEL 8.8 E4S | opendnssec | 2.1.7-1.module+el8.4.0+9007+5084bdd8 | RHSA-2025:17645 |
| RHEL 8.8 E4S | python-jwcrypto +1 | 0.5.0-1.1.module+el8.7.0+15888+685a878f | RHSA-2025:17645 |
| RHEL 8.8 E4S | python-kdcproxy +1 | 0.4-5.module+el8.2.0+4691+a05b2456 | RHSA-2025:17645 |
| RHEL 8.8 E4S | python-qrcode +2 | 5.1-12.module+el8.1.0+4107+4a66eb87 | RHSA-2025:17645 |
| RHEL 8.8 E4S | python-yubico +1 | 1.3.2-9.1.module+el8.7.0+15691+2b2c1dd5 | RHSA-2025:17645 |
| RHEL 8.8 E4S | pyusb +1 | 1.0.0-9.1.module+el8.7.0+15691+2b2c1dd5 | RHSA-2025:17645 |
| RHEL 8.8 E4S | slapi-nis | 0.60.0-4.module+el8.8.0+20635+330e3683 | RHSA-2025:17645 |
| RHEL 8.8 E4S | softhsm +1 | 2.6.0-5.module+el8.4.0+10227+076cd560 | RHSA-2025:17645 |
| RHEL 8.6 TUS | bind-dyndb-ldap | 11.6-4.module+el8.6.0+21751+4d78cb83.3 | RHSA-2025:17646 |
| RHEL 8.6 TUS | custodia +1 | 0.6.0-3.module+el8.1.0+4098+f286395e | RHSA-2025:17646 |
| RHEL 8.6 TUS | ipa +9 | 4.9.8-13.module+el8.6.0+23516+839a2a7e.3 | RHSA-2025:17646 |
| RHEL 8.6 TUS | ipa-healthcheck +1 | 0.7-10.module+el8.6.0+14300+0c339766 | RHSA-2025:17646 |
| RHEL 8.6 TUS | ipa-server +5 | 4.9.8-13.module+el8.6.0+23515+f1d338b7.3 | RHSA-2025:17646 |
| RHEL 8.6 TUS | opendnssec | 2.1.7-1.module+el8.4.0+9007+5084bdd8 | RHSA-2025:17646 |
| RHEL 8.6 TUS | python-jwcrypto +1 | 0.5.0-1.module+el8.1.0+4107+4a66eb87 | RHSA-2025:17646 |
| RHEL 8.6 TUS | python-kdcproxy +1 | 0.4-5.module+el8.2.0+4691+a05b2456 | RHSA-2025:17646 |
| RHEL 8.6 TUS | python-qrcode +2 | 5.1-12.module+el8.1.0+4107+4a66eb87 | RHSA-2025:17646 |
| RHEL 8.6 TUS | python-yubico +1 | 1.3.2-9.module+el8.1.0+4107+4a66eb87 | RHSA-2025:17646 |
| RHEL 8.6 TUS | pyusb +1 | 1.0.0-9.module+el8.1.0+4107+4a66eb87 | RHSA-2025:17646 |
| RHEL 8.6 TUS | slapi-nis | 0.60.0-1.module+el8.6.0+16878+6c033536 | RHSA-2025:17646 |
| RHEL 8.6 TUS | softhsm +1 | 2.6.0-5.module+el8.4.0+10227+076cd560 | RHSA-2025:17646 |
| RHEL 8.6 E4S | bind-dyndb-ldap | 11.6-4.module+el8.6.0+21751+4d78cb83.3 | RHSA-2025:17646 |
| RHEL 8.6 E4S | custodia +1 | 0.6.0-3.module+el8.1.0+4098+f286395e | RHSA-2025:17646 |
| RHEL 8.6 E4S | ipa +9 | 4.9.8-13.module+el8.6.0+23516+839a2a7e.3 | RHSA-2025:17646 |
| RHEL 8.6 E4S | ipa-healthcheck +1 | 0.7-10.module+el8.6.0+14300+0c339766 | RHSA-2025:17646 |
| RHEL 8.6 E4S | ipa-server +5 | 4.9.8-13.module+el8.6.0+23515+f1d338b7.3 | RHSA-2025:17646 |
| RHEL 8.6 E4S | opendnssec | 2.1.7-1.module+el8.4.0+9007+5084bdd8 | RHSA-2025:17646 |
| RHEL 8.6 E4S | python-jwcrypto +1 | 0.5.0-1.module+el8.1.0+4107+4a66eb87 | RHSA-2025:17646 |
| RHEL 8.6 E4S | python-kdcproxy +1 | 0.4-5.module+el8.2.0+4691+a05b2456 | RHSA-2025:17646 |
| RHEL 8.6 E4S | python-qrcode +2 | 5.1-12.module+el8.1.0+4107+4a66eb87 | RHSA-2025:17646 |
| RHEL 8.6 E4S | python-yubico +1 | 1.3.2-9.module+el8.1.0+4107+4a66eb87 | RHSA-2025:17646 |
| RHEL 8.6 E4S | pyusb +1 | 1.0.0-9.module+el8.1.0+4107+4a66eb87 | RHSA-2025:17646 |
| RHEL 8.6 E4S | slapi-nis | 0.60.0-1.module+el8.6.0+16878+6c033536 | RHSA-2025:17646 |
| RHEL 8.6 E4S | softhsm +1 | 2.6.0-5.module+el8.4.0+10227+076cd560 | RHSA-2025:17646 |
| RHEL 8.6 AUS | bind-dyndb-ldap | 11.6-4.module+el8.6.0+21751+4d78cb83.3 | RHSA-2025:17646 |
| RHEL 8.6 AUS | custodia +1 | 0.6.0-3.module+el8.1.0+4098+f286395e | RHSA-2025:17646 |
| RHEL 8.6 AUS | ipa +9 | 4.9.8-13.module+el8.6.0+23516+839a2a7e.3 | RHSA-2025:17646 |
| RHEL 8.6 AUS | ipa-healthcheck +1 | 0.7-10.module+el8.6.0+14300+0c339766 | RHSA-2025:17646 |
| RHEL 8.6 AUS | ipa-server +5 | 4.9.8-13.module+el8.6.0+23515+f1d338b7.3 | RHSA-2025:17646 |
| RHEL 8.6 AUS | opendnssec | 2.1.7-1.module+el8.4.0+9007+5084bdd8 | RHSA-2025:17646 |
| RHEL 8.6 AUS | python-jwcrypto +1 | 0.5.0-1.module+el8.1.0+4107+4a66eb87 | RHSA-2025:17646 |
| RHEL 8.6 AUS | python-kdcproxy +1 | 0.4-5.module+el8.2.0+4691+a05b2456 | RHSA-2025:17646 |
| RHEL 8.6 AUS | python-qrcode +2 | 5.1-12.module+el8.1.0+4107+4a66eb87 | RHSA-2025:17646 |
| RHEL 8.6 AUS | python-yubico +1 | 1.3.2-9.module+el8.1.0+4107+4a66eb87 | RHSA-2025:17646 |
| RHEL 8.6 AUS | pyusb +1 | 1.0.0-9.module+el8.1.0+4107+4a66eb87 | RHSA-2025:17646 |
| RHEL 8.6 AUS | slapi-nis | 0.60.0-1.module+el8.6.0+16878+6c033536 | RHSA-2025:17646 |
| RHEL 8.6 AUS | softhsm +1 | 2.6.0-5.module+el8.4.0+10227+076cd560 | RHSA-2025:17646 |
| RHEL 8.4 EUS Long Life | bind-dyndb-ldap | 11.6-2.module+el8.4.0+21736+855b82c8.1 | RHSA-2025:17647 |
| RHEL 8.4 EUS Long Life | custodia +1 | 0.6.0-3.module+el8.1.0+4098+f286395e | RHSA-2025:17647 |
| RHEL 8.4 EUS Long Life | ipa +9 | 4.9.2-10.module+el8.4.0+23539+5ff946c9.4 | RHSA-2025:17647 |
| RHEL 8.4 EUS Long Life | ipa-healthcheck +1 | 0.7-3.module+el8.4.0+9008+94c5103b | RHSA-2025:17647 |
| RHEL 8.4 EUS Long Life | ipa-server +5 | 4.9.2-10.module+el8.4.0+23538+139c657e.4 | RHSA-2025:17647 |
| RHEL 8.4 EUS Long Life | opendnssec | 2.1.7-1.module+el8.4.0+9007+5084bdd8 | RHSA-2025:17647 |
| RHEL 8.4 EUS Long Life | python-jwcrypto +1 | 0.5.0-1.module+el8.1.0+4107+4a66eb87 | RHSA-2025:17647 |
| RHEL 8.4 EUS Long Life | python-kdcproxy +1 | 0.4-5.module+el8.2.0+4691+a05b2456 | RHSA-2025:17647 |
| RHEL 8.4 EUS Long Life | python-qrcode +2 | 5.1-12.module+el8.1.0+4107+4a66eb87 | RHSA-2025:17647 |
| RHEL 8.4 EUS Long Life | python-yubico +1 | 1.3.2-9.module+el8.1.0+4107+4a66eb87 | RHSA-2025:17647 |
| RHEL 8.4 EUS Long Life | pyusb +1 | 1.0.0-9.module+el8.1.0+4107+4a66eb87 | RHSA-2025:17647 |
| RHEL 8.4 EUS Long Life | slapi-nis | 0.56.6-2.1.module+el8.4.0+12579+0538eac8 | RHSA-2025:17647 |
| RHEL 8.4 EUS Long Life | softhsm +1 | 2.6.0-5.module+el8.4.0+10227+076cd560 | RHSA-2025:17647 |
| RHEL 8.4 AUS | bind-dyndb-ldap | 11.6-2.module+el8.4.0+21736+855b82c8.1 | RHSA-2025:17647 |
| RHEL 8.4 AUS | custodia +1 | 0.6.0-3.module+el8.1.0+4098+f286395e | RHSA-2025:17647 |
| RHEL 8.4 AUS | ipa +9 | 4.9.2-10.module+el8.4.0+23539+5ff946c9.4 | RHSA-2025:17647 |
| RHEL 8.4 AUS | ipa-healthcheck +1 | 0.7-3.module+el8.4.0+9008+94c5103b | RHSA-2025:17647 |
| RHEL 8.4 AUS | ipa-server +5 | 4.9.2-10.module+el8.4.0+23538+139c657e.4 | RHSA-2025:17647 |
| RHEL 8.4 AUS | opendnssec | 2.1.7-1.module+el8.4.0+9007+5084bdd8 | RHSA-2025:17647 |
| RHEL 8.4 AUS | python-jwcrypto +1 | 0.5.0-1.module+el8.1.0+4107+4a66eb87 | RHSA-2025:17647 |
| RHEL 8.4 AUS | python-kdcproxy +1 | 0.4-5.module+el8.2.0+4691+a05b2456 | RHSA-2025:17647 |
| RHEL 8.4 AUS | python-qrcode +2 | 5.1-12.module+el8.1.0+4107+4a66eb87 | RHSA-2025:17647 |
| RHEL 8.4 AUS | python-yubico +1 | 1.3.2-9.module+el8.1.0+4107+4a66eb87 | RHSA-2025:17647 |
| RHEL 8.4 AUS | pyusb +1 | 1.0.0-9.module+el8.1.0+4107+4a66eb87 | RHSA-2025:17647 |
| RHEL 8.4 AUS | slapi-nis | 0.56.6-2.1.module+el8.4.0+12579+0538eac8 | RHSA-2025:17647 |
| RHEL 8.4 AUS | softhsm +1 | 2.6.0-5.module+el8.4.0+10227+076cd560 | RHSA-2025:17647 |
| RHEL 8.2 AUS | bind-dyndb-ldap | 11.2-3.module+el8.2.0+21753+7109ce90.3 | RHSA-2025:17648 |
| RHEL 8.2 AUS | custodia +1 | 0.6.0-3.module+el8.1.0+4098+f286395e | RHSA-2025:17648 |
| RHEL 8.2 AUS | ipa +7 | 4.8.4-14.module+el8.2.0+23545+ad5241a1.10 | RHSA-2025:17648 |
| RHEL 8.2 AUS | ipa-healthcheck +1 | 0.4-4.module+el8.2.0+5496+53199ee7 | RHSA-2025:17648 |
| RHEL 8.2 AUS | ipa-idoverride-memberof +1 | 0.0.4-6.module+el8.1.0+4098+f286395e | RHSA-2025:17648 |
| RHEL 8.2 AUS | ipa-server +4 | 4.8.4-14.module+el8.2.0+23544+91c528c8.10 | RHSA-2025:17648 |
| RHEL 8.2 AUS | opendnssec | 1.4.14-1.module+el8.1.0+4098+f286395e | RHSA-2025:17648 |
| RHEL 8.2 AUS | python-jwcrypto +1 | 0.5.0-1.module+el8.1.0+4107+4a66eb87 | RHSA-2025:17648 |
| RHEL 8.2 AUS | python-kdcproxy +1 | 0.4-5.module+el8.2.0+4691+a05b2456 | RHSA-2025:17648 |
| RHEL 8.2 AUS | python-qrcode +2 | 5.1-12.module+el8.1.0+4107+4a66eb87 | RHSA-2025:17648 |
| RHEL 8.2 AUS | python-yubico +1 | 1.3.2-9.module+el8.1.0+4107+4a66eb87 | RHSA-2025:17648 |
| RHEL 8.2 AUS | pyusb +1 | 1.0.0-9.module+el8.1.0+4107+4a66eb87 | RHSA-2025:17648 |
| RHEL 8.2 AUS | slapi-nis | 0.56.3-3.module+el8.2.0+10782+8facb0b2 | RHSA-2025:17648 |
| RHEL 8.2 AUS | softhsm +1 | 2.4.0-4.module+el8.2.0+5779+a38c524f | RHSA-2025:17648 |
| RHEL 7 ELS | ipa +11 | 4.6.8-5.el7_9.23 | RHSA-2025:17649 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | ipa-common +10 | 4.12.2-24.el10_1.1 | ALSA-2025:20994 |
| AlmaLinux 9 | ipa-client +17 | 4.12.2-14.el9_6.5 | ALSA-2025:20928, ALSA-2025:17084 |
| AlmaLinux 8 | bind-dyndb-ldap | 11.6-6.module_el8.10.0+3980+d78e8e90 | ALSA-2025:17129 |
| AlmaLinux 8 | custodia +1 | 0.6.0-3.module_el8.6.0+2881+2f24dc92 | ALSA-2025:17129 |
| AlmaLinux 8 | ipa-client +14 | 4.9.13-20.module_el8.10.0+4050+3b475c71 | ALSA-2025:17129 |
| AlmaLinux 8 | ipa-healthcheck +1 | 0.12-6.module_el8.10.0+4036+84b152d9 | ALSA-2025:17129 |
| AlmaLinux 8 | opendnssec | 2.1.7-2.module_el8.10.0+3980+d78e8e90 | ALSA-2025:17129 |
| AlmaLinux 8 | python3-jwcrypto | 0.5.0-2.module_el8.10.0+3844+20e075e5 | ALSA-2025:17129 |
| AlmaLinux 8 | python3-kdcproxy | 0.4-5.module_el8.10.0+3942+63b39a46.1 | ALSA-2025:17129 |
| AlmaLinux 8 | python3-pyusb | 1.0.0-9.1.module_el8.7.0+3349+cfeff52e | ALSA-2025:17129 |
| AlmaLinux 8 | python3-qrcode +1 | 5.3-1.module_el8.10.0+3942+63b39a46 | ALSA-2025:17129 |
| AlmaLinux 8 | python3-yubico | 1.3.2-9.1.module_el8.7.0+3349+cfeff52e | ALSA-2025:17129 |
| AlmaLinux 8 | slapi-nis | 0.60.0-4.module_el8.10.0+3844+20e075e5.alma.1 | ALSA-2025:17129 |
| AlmaLinux 8 | softhsm +1 | 2.6.0-5.module_el8.6.0+2881+2f24dc92 | ALSA-2025:17129 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | ipa | 4.12.2-15.el10_0.4 | RLSA-2025:20994, RLSA-2025:17085 |
| Rocky Linux 9 | ipa | 4.12.2-14.el9_6.5 | RLSA-2025:20928, RLSA-2025:17084 |
| Rocky Linux 8 | bind-dyndb-ldap | 11.6-6.module+el8.10.0+1960+1ed527b3 | RLSA-2025:17129 |
| Rocky Linux 8 | custodia | 0.6.0-3.module+el8.9.0+1371+ffa84eb9 | RLSA-2025:17129 |
| Rocky Linux 8 | ipa | 4.9.13-20.module+el8.10.0+2066+d74ade98 | RLSA-2025:17129 |
| Rocky Linux 8 | ipa-healthcheck | 0.12-6.module+el8.10.0+2053+a0a9dc19 | RLSA-2025:17129 |
| Rocky Linux 8 | opendnssec | 2.1.7-2.module+el8.10.0+1960+1ed527b3 | RLSA-2025:17129 |
| Rocky Linux 8 | python-jwcrypto | 0.5.0-2.module+el8.10.0+1818+2dfda7a6 | RLSA-2025:17129 |
| Rocky Linux 8 | python-kdcproxy | 0.4-5.module+el8.9.0+1371+ffa84eb9 | RLSA-2025:17129 |
| Rocky Linux 8 | python-qrcode | 5.3-1.module+el8.10.0+1915+3c70f7d9 | RLSA-2025:17129 |
| Rocky Linux 8 | python-yubico | 1.3.2-9.1.module+el8.9.0+1371+ffa84eb9 | RLSA-2025:17129 |
| Rocky Linux 8 | pyusb | 1.0.0-9.1.module+el8.9.0+1371+ffa84eb9 | RLSA-2025:17129 |
| Rocky Linux 8 | slapi-nis | 0.60.0-4.module+el8.9.0+1573+39ab85f4 | RLSA-2025:17129 |
| Rocky Linux 8 | softhsm | 2.6.0-5.module+el8.9.0+1371+ffa84eb9 | RLSA-2025:17129 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | 389-ds-base +3 | 1.3.10.2-17.amzn2.0.4 | ALAS2-2025-3025 |
| Amazon Linux 2 | ipa-client +10 | 4.6.8-5.amzn2.17.3 | ALAS2-2025-3026 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | 389-ds-base | No fix yet | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | ipa-client +17 | 4.12.2-15.0.1.el10_0.4 | ELSA-2025-20994, ELSA-2025-17085 |
| Oracle Linux 9 | ipa-client +17 | 4.12.2-14.0.1.el9_6.5 | ELSA-2025-20928, ELSA-2025-17084 |
| Oracle Linux 8 | bind-dyndb-ldap | 11.6-6.module+el8.10.0+90553+1bd85afa | ELSA-2025-17129 |
| Oracle Linux 8 | custodia +1 | 0.6.0-3.module+el8.9.0+90094+20819f5a | ELSA-2025-17129 |
| Oracle Linux 8 | ipa-client +14 | 4.9.13-20.0.1.module+el8.10.0+90676+16d53ab4 | ELSA-2025-17129 |
| Oracle Linux 8 | ipa-healthcheck +1 | 0.12-6.module+el8.10.0+90676+16d53ab4 | ELSA-2025-17129 |
| Oracle Linux 8 | opendnssec | 2.1.7-2.module+el8.10.0+90553+1bd85afa | ELSA-2025-17129 |
| Oracle Linux 8 | python3-jwcrypto | 0.5.0-2.module+el8.10.0+90573+7d6bd8da | ELSA-2025-17129 |
| Oracle Linux 8 | python3-kdcproxy | 0.4-5.module+el8.10.0+90553+1bd85afa.1 | ELSA-2025-17129 |
| Oracle Linux 8 | python3-pyusb | 1.0.0-9.1.module+el8.9.0+90094+20819f5a | ELSA-2025-17129 |
| Oracle Linux 8 | python3-qrcode +1 | 5.3-1.module+el8.10.0+90676+16d53ab4 | ELSA-2025-17129 |
| Oracle Linux 8 | python3-yubico | 1.3.2-9.1.module+el8.9.0+90094+20819f5a | ELSA-2025-17129 |
| Oracle Linux 8 | slapi-nis | 0.60.0-4.module+el8.10.0+90297+bfe93ccc | ELSA-2025-17129 |
| Oracle Linux 8 | softhsm +1 | 2.6.0-5.module+el8.9.0+90094+20819f5a | ELSA-2025-17129 |
| Oracle Linux 7 | ipa-client +10 | 4.6.8-5.0.5.el7_9.17 | ELSA-2025-17649 |
Advisories 31
- ALSA-2025:20928 Important: ipa security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:17084 Important: ipa security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:20994 Important: ipa security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:17129 Important: idm:DL1 security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2025:20994 Red Hat Security Advisory: ipa security update Red Hat Security Advisories (RHSA) · Jul 12, 2026
- RHSA-2025:20928 Red Hat Security Advisory: ipa security update Red Hat Security Advisories (RHSA) · Jul 12, 2026
- RHSA-2025:17648 Red Hat Security Advisory: idm:DL1 security update Red Hat Security Advisories (RHSA) · Jul 12, 2026
- RHSA-2025:17649 Red Hat Security Advisory: ipa security update Red Hat Security Advisories (RHSA) · Jul 12, 2026
- RHSA-2025:17646 Red Hat Security Advisory: idm:client security update Red Hat Security Advisories (RHSA) · Jul 12, 2026
- RHSA-2025:17647 Red Hat Security Advisory: idm:DL1 security update Red Hat Security Advisories (RHSA) · Jul 12, 2026
- RHSA-2025:17645 Red Hat Security Advisory: idm:client security update Red Hat Security Advisories (RHSA) · Jul 12, 2026
- RHSA-2025:17129 Red Hat Security Advisory: idm:DL1 security update Red Hat Security Advisories (RHSA) · Jul 12, 2026
- RHSA-2025:17087 Red Hat Security Advisory: ipa security update Red Hat Security Advisories (RHSA) · Jul 12, 2026
- RHSA-2025:17088 Red Hat Security Advisory: ipa security update Red Hat Security Advisories (RHSA) · Jul 12, 2026
- RHSA-2025:17086 Red Hat Security Advisory: ipa security update Red Hat Security Advisories (RHSA) · Jul 12, 2026
- RHSA-2025:17085 Red Hat Security Advisory: ipa security update Red Hat Security Advisories (RHSA) · Jul 12, 2026
- RHSA-2025:17084 Red Hat Security Advisory: ipa security update Red Hat Security Advisories (RHSA) · Jul 12, 2026
- RLSA-2025:17129 Important: idm:DL1 security update Rocky Linux Security Advisories · Mar 18, 2026
- WID-SEC-2025-2164 Red Hat Enterprise Linux (FreeIPA): Schwachstelle ermöglicht Erlangen von Administratorrechten BSI CERT-Bund (WID) · Mar 17, 2026
- ELSA-2025-20994 Important: ipa security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Dec 2, 2025
- ELSA-2025-20928 Important: ipa security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Nov 25, 2025
- RLSA-2025:20928 Important: ipa security update Rocky Linux Security Advisories · Nov 21, 2025
- RLSA-2025:20994 Important: ipa security update Rocky Linux Security Advisories · Nov 21, 2025
- ELSA-2025-17649 Important: ipa security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Nov 11, 2025
- RLSA-2025:17084 Important: ipa security update Rocky Linux Security Advisories · Oct 10, 2025
- RLSA-2025:17085 Important: ipa security update Rocky Linux Security Advisories · Oct 8, 2025
- ALAS2-2025-3025 Critical: 389-ds-base security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Oct 7, 2025
- ALAS2-2025-3026 Critical: ipa security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Oct 7, 2025
- ELSA-2025-17085 Important: ipa security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Oct 2, 2025
- ELSA-2025-17084 Important: ipa security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Oct 1, 2025
- ELSA-2025-17129 Important: idm:DL1 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Oct 1, 2025
References
- RHSA-2025:17084 vendor-advisory
- RHSA-2025:17085 vendor-advisory
- RHSA-2025:17086 vendor-advisory
- RHSA-2025:17087 vendor-advisory
- RHSA-2025:17088 vendor-advisory
- RHSA-2025:17129 vendor-advisory
- RHSA-2025:17645 vendor-advisory
- RHSA-2025:17646 vendor-advisory
- RHSA-2025:17647 vendor-advisory
- RHSA-2025:17648 vendor-advisory
- RHSA-2025:17649 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2025-7493 vdb-entry
- RHBZ#2389448 issue-tracking