CVE-2024-11029

EUVD-2024-34378
A flaw was found in the FreeIPA API audit, where it sends the whole FreeIPA command line to journalctl. As a consequence, during the FreeIPA installation process, it inadvertently leaks the administrative user credentials, including the administrator password, to the journal database. In the worst-case scenario, where the journal log is centralized, users with access to it can have improper access to the FreeIPA administrator credentials.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.5 MEDIUM
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 3%
Debian logo
Debian Releases
Debian Product
Codename
freeipa
bookworm
no-dsa
forky
4.12.4-2
fixed
sid
4.12.4-2
fixed
trixie
4.12.4-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
freeipa
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
oracular
ignored
plucky
needs-triage
questing
needs-triage
trusty
needs-triage
xenial
needs-triage
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
ipa-client
RHEL 9
0:4.12.2-1.el9_5.3
fixed
ipa-client-common
RHEL 9
0:4.12.2-1.el9_5.3
fixed
ipa-client-epn
RHEL 9
0:4.12.2-1.el9_5.3
fixed
ipa-client-samba
RHEL 9
0:4.12.2-1.el9_5.3
fixed
ipa-common
RHEL 9
0:4.12.2-1.el9_5.3
fixed
ipa-selinux
RHEL 9
0:4.12.2-1.el9_5.3
fixed
ipa-selinux-luna
RHEL 9
0:4.12.2-1.el9_5.3
fixed
ipa-selinux-nfast
RHEL 9
0:4.12.2-1.el9_5.3
fixed
ipa-server
RHEL 9
0:4.12.2-1.el9_5.3
fixed
ipa-server-common
RHEL 9
0:4.12.2-1.el9_5.3
fixed
ipa-server-dns
RHEL 9
0:4.12.2-1.el9_5.3
fixed
ipa-server-trust-ad
RHEL 9
0:4.12.2-1.el9_5.3
fixed
python3-ipaclient
RHEL 9
0:4.12.2-1.el9_5.3
fixed
python3-ipalib
RHEL 9
0:4.12.2-1.el9_5.3
fixed
python3-ipaserver
RHEL 9
0:4.12.2-1.el9_5.3
fixed
python3-ipatests
RHEL 9
0:4.12.2-1.el9_5.3
fixed