PT-2019-1082 · Red Hat+1 · Ipa+2

Todd Lipcon · Publicado 2019-11-27 · Atualizado 2021-12-06 · CVE-2019-14867

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IPA versions 4.6.x before 4.6.7 IPA versions 4.7.x before 4.7.4 IPA versions 4.8.x before 4.8.3

Description A flaw was found in the way the internal function ber scanf() was used in some components of the IPA server, which parsed kerberos key data. An unauthenticated attacker who could trigger parsing of the krb principal key could cause the IPA server to crash or, in some conditions, execute arbitrary code on the server hosting the IPA server.

Recommendations For IPA versions 4.6.x before 4.6.7, update to version 4.6.7 or later. For IPA versions 4.7.x before 4.7.4, update to version 4.7.4 or later. For IPA versions 4.8.x before 4.8.3, update to version 4.8.3 or later.

Correção

Code Injection

Resource Exhaustion

Enumeração de Fraquezas

CWE-94

CWE-400

Identificadores relacionados

ALBA-2019:4268

ALT-PU-2019-3193

ALT-PU-2019-3206

CVE-2019-14867

GHSA-7HPJ-HFCR-5QWM

PYSEC-2019-28

PYSEC-2019-98

RHSA-2020:0378

RHSA-2020:1269

RHSA-2020_0378

Produtos afetados

Alt Linux

Ipa

Red Hat

Referências · 37

• https://github.com/pypa/advisory-db/tree/main/vulns/ipa/PYSEC-2019-28.yaml · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/ipa/PYSEC-2019-28.yaml · Nota
• https://access.redhat.com/errata/RHSA-2020:0378 · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/WLFL5XDCJ3WT6JCLCQVKHZBLHGW7PW4T · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2019-14867 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14867 · Nota
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/67SEUWJAJ5RMH5K4Q6TS2I7HIMXUGNKF · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2019-14867 · Nota
• https://access.redhat.com/errata/RHBA-2019:4268 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-7hpj-hfcr-5qwm · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-14867 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-14867 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2019-14867 · Aviso do Fabricante
• https://freeipa.org/page/Releases/4.8.3 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-14867 · Aviso do Fabricante