CVE-2024-11029: Freeipa: administrative user data leaked through systemd journal
A flaw was found in the FreeIPA API audit, where it sends the whole FreeIPA command line to journalctl. As a consequence, during the FreeIPA installation process, it inadvertently leaks the administrative user credentials, including the administrator password, to the journal database. In the worst-case scenario, where the journal log is centralized, users with access to it can have improper access to the FreeIPA administrator credentials.
Other sources
The FreeIPA API audit sends the whole FreeIPA ccommand line to journalctl, as consequence during the FreeIPA installation process inadvertently ends up leaking the administrative user credentials (including the administrator password) to the journal database. On worst case scenario where the journal log is centralized, users with access to it can have improper access to the FreeIPA administrator credentials.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-11029?
CVE-2024-11029 is considered a critical severity vulnerability due to the potential exposure of administrative credentials.
How do I fix CVE-2024-11029?
To fix CVE-2024-11029, upgrade to the latest version of FreeIPA that addresses this vulnerability.
What type of vulnerability is CVE-2024-11029?
CVE-2024-11029 is an information disclosure vulnerability that leaks sensitive administrative user credentials.
What versions of FreeIPA are affected by CVE-2024-11029?
CVE-2024-11029 affects multiple versions of FreeIPA, particularly those that include the flawed API audit feature.
When was CVE-2024-11029 disclosed?
CVE-2024-11029 was disclosed in 2024 and is currently being addressed by the FreeIPA development team.