REDHAT-BUG-2325557
First published: Tue Nov 12 2024(Updated: )
The FreeIPA API audit sends the whole FreeIPA ccommand line to journalctl, as consequence during the FreeIPA installation process inadvertently ends up leaking the administrative user credentials (including the administrator password) to the journal database. On worst case scenario where the journal log is centralized, users with access to it can have improper access to the FreeIPA administrator credentials.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| FreeIPA |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of REDHAT-BUG-2325557?
The severity of REDHAT-BUG-2325557 is considered critical due to the leakage of administrative user credentials.
How do I fix REDHAT-BUG-2325557?
To fix REDHAT-BUG-2325557, ensure you update FreeIPA to the latest version where this issue has been patched.
Who is affected by REDHAT-BUG-2325557?
Users of FreeIPA who have installed the software are affected by REDHAT-BUG-2325557.
What are the risks associated with REDHAT-BUG-2325557?
The risks associated with REDHAT-BUG-2325557 include potential unauthorized access to sensitive administrative credentials.
When was REDHAT-BUG-2325557 reported?
REDHAT-BUG-2325557 was reported on October 9, 2023.
- agent/severity
- agent/type
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2024-11029
- agent/references
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/freeipa
- canonical/freeipa