CVE-2020-1722 — Uncontrolled Resource Consumption in Freeipa

CWE-400 — Uncontrolled Resource Consumption9 documents8 sources
Severity
5.3MEDIUMNVD
EPSS
0.4%
top 41.23%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
FreeipaRED HAT IPARedhat Enterprise Linux
Timeline
PublishedApr 27
Latest updateMay 24

Description

A flaw was found in all ipa versions 4.x.x through 4.8.0. When sending a very long password (>= 1,000,000 characters) to the server, the password hashing process could exhaust memory and CPU leading to a denial of service and the website becoming unresponsive. The highest threat from this vulnerability is to system availability.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 1.6 | Impact: 3.6

Affected Packages3 packages

▶Debianfreeipa/freeipa< 4.8.8-2+2
▶NVDfreeipa/freeipa4.0.0 — 4.8.0
▶CVEListV5red_hat/ipaall ipa versions 4.x.x through 4.8.0

Also affects: Enterprise Linux 6.0, 7.0, 8.0

🔴Vulnerability Details

3
GHSA
GHSA-mvj3-pw74-8w47: A flaw was found in all ipa versions 4↗2022-05-24
▶
CVEList
CVE-2020-1722: A flaw was found in all ipa versions 4↗2020-04-27
▶
OSV
CVE-2020-1722: A flaw was found in all ipa versions 4↗2020-04-27
▶

💥Exploits & PoCs

1
Nuclei
Jenkin Audit Trail <=3.2 - Cross-Site Scripting
▶

📋Vendor Advisories

2
Red Hat
ipa: No password length restriction leads to denial of service↗2020-04-14
▶
Debian
CVE-2020-1722: freeipa - A flaw was found in all ipa versions 4.x.x through 4.8.0. When sending a very lo...↗2020
▶

💬Community

2
Bugzilla
CVE-2020-1722 freeipa: ipa: No password length restriction leads to denial of service [fedora-all]↗2020-04-14
▶
Bugzilla
CVE-2020-1722 ipa: No password length restriction leads to denial of service↗2020-01-20
▶
CVE-2020-1722 — Uncontrolled Resource Consumption | cvebase