CVE-2019-14867

8.8HIGH

Key Information:

Vendor
Red Hat
Status
Ipa
Vendor
CVE Published:
27 November 2019

Summary

A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way the internal function ber_scanf() was used in some components of the IPA server, which parsed kerberos key data. An unauthenticated attacker who could trigger parsing of the krb principal key could cause the IPA server to crash or in some conditions, cause arbitrary code to be executed on the server hosting the IPA server.

Affected Version(s)

ipa all IPA 4.6.x versions before 4.6.7

ipa all IPA 4.7.x versions before 4.7.4

ipa all IPa 4.8.x versions before 4.8.3

References

https://www.freeipa.org/page/Releases/4.7.4
x_refsource_MISC
https://www.freeipa.org/page/Releases/4.8.3
x_refsource_MISC
https://www.freeipa.org/page/Releases/4.6.7
x_refsource_MISC

EPSS Score

1% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Collectors

NVD DatabaseMitre Database
.