Description · from the CVE record
A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI evaluation (tracked separately), to create an arbitrary attacker-controlled Kerberos principal and have it added to the administrators group. This allows a remote, unauthenticated attacker to obtain genuine FreeIPA administrator-group membership and perform administrative operations against the directory and, on SID-enabled deployments, other IdM services.
Affected
ProductAffectedFixed inSource
Red Hat Enterprise Linux 10see advisory0:4.13.4-1.el10_2CNA
Red Hat Enterprise Linux 10.0 Extended Update Supportsee advisory0:4.12.2-15.el10_0.7CNA
Red Hat Enterprise Linux 8see advisory8100020261007071200.143e9e98CNA
Red Hat Enterprise Linux 8see advisory8100020261007070536.823393f5CNA
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Supportsee advisory8060020261008134123.c1533a64CNA
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Supportsee advisory8060020261008133528.ada582f1CNA
Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-Onsee advisory8060020261008134123.c1533a64CNA
Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-Onsee advisory8060020261008133528.ada582f1CNA
Red Hat Enterprise Linux 8.8 Telecommunications Update Servicesee advisory8080020261007080925.e581a9e4CNA
Red Hat Enterprise Linux 8.8 Telecommunications Update Servicesee advisory8080020261007071832.b0a6ceeaCNA
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutionssee advisory8080020261007080925.e581a9e4CNA
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutionssee advisory8080020261007071832.b0a6ceeaCNA
by Kastro