by Kastro CVE-2025-4404
Red Hat Red Hat Enterprise Linux 10 — Freeipa: idm: privilege escalation from host to domain admin in freeipa
Description · from the CVE record
A privilege escalation from host to domain vulnerability was found in the FreeIPA project. The FreeIPA package fails to validate the uniqueness of the `krbCanonicalName` for the admin account by default, allowing users to create services with the same canonical name as the REALM admin. When a successful attack happens, the user can retrieve a Kerberos ticket in the name of this service, containing the admin@REALM credential. This flaw allows an attacker to perform administrative tasks over the REALM, leading to access to sensitive data and sensitive data exfiltration.
Affected
ProductAffectedFixed inSource
freeipa< 4.12.44.12.4CNA
Red Hat Enterprise Linux 10see advisory0:4.12.2-15.el10_0.1CNA
Red Hat Enterprise Linux 7 Extended Lifecycle Supportsee advisory0:4.6.8-5.el7_9.18CNA
Red Hat Enterprise Linux 8see advisory8100020250603150652.143e9e98CNA
Red Hat Enterprise Linux 8see advisory8100020250603134209.823393f5CNA
Red Hat Enterprise Linux 8.2 Advanced Update Supportsee advisory8020020250609031831.50ea30f9CNA
Red Hat Enterprise Linux 8.2 Advanced Update Supportsee advisory8020020250609030144.792f4060CNA
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Supportsee advisory8040020250609101903.f153676aCNA
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Supportsee advisory8040020250609095221.5b01ab7eCNA
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Supportsee advisory8060020250606060927.c1533a64CNA
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Supportsee advisory8060020250606060504.ada582f1CNA
Red Hat Enterprise Linux 8.6 Telecommunications Update Servicesee advisory8060020250606060927.c1533a64CNA
Scores by source
redhat (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total