Description (CNA)
A privilege escalation from host to domain vulnerability was found in the FreeIPA project. The FreeIPA package fails to validate the uniqueness of the `krbCanonicalName` for the admin account by default, allowing users to create services with the same canonical name as the REALM admin. When a successful attack happens, the user can retrieve a Kerberos ticket in the name of this service, containing the admin@REALM credential. This flaw allows an attacker to perform administrative tasks over the REALM, leading to access to sensitive data and sensitive data exfiltration.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Not supplied / Not supplied | affected 0 before 4.12.4 |
| Red Hat / Red Hat Enterprise Linux 10 | unaffected 0:4.12.2-15.el10_0.1 before * |
| Red Hat / Red Hat Enterprise Linux 7 Extended Lifecycle Support | unaffected 0:4.6.8-5.el7_9.18 before * |
| Red Hat / Red Hat Enterprise Linux 8 | unaffected 8100020250603150652.143e9e98 before * |
| Red Hat / Red Hat Enterprise Linux 8 | unaffected 8100020250603134209.823393f5 before * |
| Red Hat / Red Hat Enterprise Linux 8.2 Advanced Update Support | unaffected 8020020250609031831.50ea30f9 before * |
| Red Hat / Red Hat Enterprise Linux 8.2 Advanced Update Support | unaffected 8020020250609030144.792f4060 before * |
| Red Hat / Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | unaffected 8040020250609101903.f153676a before * |
| Red Hat / Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | unaffected 8040020250609095221.5b01ab7e before * |
| Red Hat / Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | unaffected 8060020250606060927.c1533a64 before * |
| Red Hat / Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | unaffected 8060020250606060504.ada582f1 before * |
| Red Hat / Red Hat Enterprise Linux 8.6 Telecommunications Update Service | unaffected 8060020250606060927.c1533a64 before * |
| Red Hat / Red Hat Enterprise Linux 8.6 Telecommunications Update Service | unaffected 8060020250606060504.ada582f1 before * |
| Red Hat / Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions | unaffected 8060020250606060927.c1533a64 before * |
| Red Hat / Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions | unaffected 8060020250606060504.ada582f1 before * |
| Red Hat / Red Hat Enterprise Linux 8.8 Telecommunications Update Service | unaffected 8080020250604195510.e581a9e4 before * |
| Red Hat / Red Hat Enterprise Linux 8.8 Telecommunications Update Service | unaffected 8080020250604202433.b0a6ceea before * |
| Red Hat / Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | unaffected 8080020250604195510.e581a9e4 before * |
| Red Hat / Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | unaffected 8080020250604202433.b0a6ceea before * |
| Red Hat / Red Hat Enterprise Linux 9 | unaffected 0:4.12.2-14.el9_6.1 before * |
| Red Hat / Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions | unaffected 0:4.9.8-11.el9_0.4 before * |
| Red Hat / Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | unaffected 0:4.10.1-12.el9_2.4 before * |
| Red Hat / Red Hat Enterprise Linux 9.4 Extended Update Support | unaffected 0:4.11.0-15.el9_4.5 before * |
| Red Hat / Red Hat Enterprise Linux 6 | unknown |
CWE
CWE-1220
References
- https://access.redhat.com/errata/RHSA-2025:9184
- https://access.redhat.com/errata/RHSA-2025:9185
- https://access.redhat.com/errata/RHSA-2025:9186
- https://access.redhat.com/errata/RHSA-2025:9187
- https://access.redhat.com/errata/RHSA-2025:9188
- https://access.redhat.com/errata/RHSA-2025:9189
- https://access.redhat.com/errata/RHSA-2025:9190
- https://access.redhat.com/errata/RHSA-2025:9191
- https://access.redhat.com/errata/RHSA-2025:9192
- https://access.redhat.com/errata/RHSA-2025:9193
- https://access.redhat.com/errata/RHSA-2025:9194
- https://access.redhat.com/security/cve/CVE-2025-4404
- https://bugzilla.redhat.com/show_bug.cgi?id=2364606
- https://pagure.io/freeipa/c/6b9400c135ed16b10057b350cc9ce42aa0e862d4
- https://pagure.io/freeipa/c/796ed20092d554ee0c9e23295e346ec1e8a0bf6e
ADP enrichment
No English description supplied.
No references supplied.
No English description supplied.