FEDORA-2019-c64e1612f5 created by abbra 3 months ago for Fedora 31
stable

FreeIPA 4.8.3 is a security update release that includes fixes for two issues:

  • CVE-2019-10195: Don't log passwords embedded in commands in calls using batch A flaw was found in the way that FreeIPA's batch processing API logged operations. This included passing user passwords in clear text on FreeIPA masters. Batch processing of commands with passwords as arguments or options is not performed by default in FreeIPA but is possible by third-party components. An attacker having access to system logs on FreeIPA masters could use this flaw to produce log file content with passwords exposed. The issue was reported by Jamison Bennett from Cloudera

  • CVE-2019-14867: Make sure to have storage space for tag A flaw was found in the way the internal function ber_scanf() was used in some components of the IPA server, which parsed kerberos key data. An unauthenticated attacker who could trigger parsing of the krb principal key could cause the IPA server to crash or in some conditions, cause arbitrary code to be executed on the server hosting the IPA server. The issue was reported by Todd Lipcon from Cloudera

How to install

sudo dnf upgrade --advisory=FEDORA-2019-c64e1612f5

This update has been submitted for testing by abbra.

3 months ago

This update's test gating status has been changed to 'waiting'.

3 months ago

This update's test gating status has been changed to 'ignored'.

3 months ago

This update has been pushed to testing.

3 months ago

abbra edited this update.

3 months ago

This update can be pushed to stable now if the maintainer wishes

2 months ago

This update has been submitted for stable by bodhi.

2 months ago

This update has been pushed to stable.

2 months ago

Please login to add feedback.

Metadata
Type
security
Severity
high
Karma
0
Signed
Content Type
RPM
Test Gating
Settings
Unstable by Karma
-3
Stable by Karma
3
Stable by Time
7 days
Dates
submitted
3 months ago
in testing
3 months ago
in stable
2 months ago
modified
3 months ago
BZ#1777147 CVE-2019-10195 freeipa: IPA: batch API logging user passwords to /var/log/httpd/error_log [fedora-all]
0
0
BZ#1777200 CVE-2019-14867 freeipa: ipa: Denial of service in IPA server due to wrong use of ber_scanf() [fedora-all]
0
0

Automated Test Results