PT-2018-5377 · Red Hat+1 · Freeipa+1

Adam Mariš · Published 2017-01-09 · Updated 2018-04-17 · CVE-2017-12169

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions FreeIPA versions 4.2.0 and later

Description A security issue was discovered where FreeIPA could disclose password hashes to users with the System: Read Stage Users permission. A remote, authenticated attacker could potentially use this flaw to disclose the password hashes belonging to Stage Users. This issue does not result in the disclosure of password hashes belonging to active standard users.

Recommendations For FreeIPA versions 4.2.0 and later, consider restricting the System: Read Stage Users permission to minimize the risk of exploitation. As a temporary workaround, consider disabling the Stage User activation feature until a design change or patch is available. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2025-05018

CVE-2017-12169

Affected Products

Debian

Freeipa

References · 11

• https://cve.org/CVERecord?id=CVE-2017-12169 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-12169 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-12169 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-05018 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-12169 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2017-12169 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-12169 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-12169 · Vendor Advisory
• http://securityfocus.com/bid/102136 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1487697 · Note
• https://clouddefense.ai/cve/2017/CVE-2017-12169 · Note