CVE-2019-10195 — Sensitive Information Exposure in Freeipa

CWE-200 — Sensitive Information ExposureCWE-532 — Log File Information ExposureCWE-538 — Insertion of Sensitive Information into Externally-Accessible File or Directory9 documents7 sources
Severity
6.5MEDIUMNVD
EPSS
0.6%
top 29.17%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
FreeipaRED HAT IPAFedoraproject Fedora
Timeline
PublishedNov 27
Latest updateMay 24

Description

A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way that FreeIPA's batch processing API logged operations. This included passing user passwords in clear text on FreeIPA masters. Batch processing of commands with passwords as arguments or options is not performed by default in FreeIPA but is possible by third-party components. An attacker having access to system logs on FreeIPA masters could use this flaw to pro…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages5 packages

▶NVDfreeipa/freeipa4.6.0 — 4.6.7+2
▶PyPIfreeipa/freeipa4.6.0 — 4.6.7+2
▶Debianfreeipa/freeipa< 4.8.3-1+2
▶PyPIred_hat/ipa4.6.0 — 4.6.7+2
▶CVEListV5red_hat/ipaall IPA 4.6.x versions before 4.6.7, all IPA 4.7.x versions before 4.7.4, all IPa 4.8.x versions before 4.8.3+2

Also affects: Fedora 30, 31

🔴Vulnerability Details

4
GHSA
FreeIPA logs passwords embedded in commands in calls using batch↗2022-05-24
▶
OSV
FreeIPA logs passwords embedded in commands in calls using batch↗2022-05-24
▶
CVEList
CVE-2019-10195: A flaw was found in IPA, all 4↗2019-11-27
▶
OSV
CVE-2019-10195: A flaw was found in IPA, all 4↗2019-11-27
▶

📋Vendor Advisories

2
Red Hat
ipa: Batch API logging user passwords to /var/log/httpd/error_log↗2019-11-26
▶
Debian
CVE-2019-10195: freeipa - A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions bef...↗2019
▶

💬Community

2
Bugzilla
CVE-2019-10195 freeipa: IPA: batch API logging user passwords to /var/log/httpd/error_log [fedora-all]↗2019-11-27
▶
Bugzilla
CVE-2019-10195 ipa: Batch API logging user passwords to /var/log/httpd/error_log↗2019-07-02
▶
CVE-2019-10195 — Sensitive Information Exposure | cvebase