PT-2020-14913 · Freeipa+6 · Ipa+6

Published 2020-04-20 · Updated 2023-02-12 · CVE-2020-1722

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ipa versions 4.x.x through 4.8.0

Description A flaw was found in the password hashing process. When a very long password (>= 1,000,000 characters) is sent to the server, it could exhaust memory and CPU, leading to a denial of service and the website becoming unresponsive. The highest threat from this issue is to system availability.

Recommendations For ipa versions 4.x.x through 4.8.0, consider restricting the length of passwords that can be sent to the server to prevent exhaustion of memory and CPU. As a temporary workaround, implement measures to limit the impact of a denial of service, such as monitoring system resources and configuring the server to handle high loads. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

ALSA-2020:4670

ALT-PU-2020-1782

ALT-PU-2020-2174

CESA-2020_3936

CESA-2020_4670

CVE-2020-1722

RHSA-2020:3936

RHSA-2020:4670

RHSA-2020_3936

RHSA-2020_4670

RLSA-2020:4670

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Red Hat

Rocky Linux

Ipa

References · 90

• 🔥 https://github.com/0xAJ2K/CVE-2020-11022-CVE-2020-11023 · Exploit
• 🔥 https://github.com/halkichi0308/CVE-2015-9251 · Exploit
• 🔥 https://github.com/ossf-cve-benchmark/CVE-2020-11022 · Exploit
• https://security-tracker.debian.org/tracker/CVE-2020-1722 · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2020-4670.html · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2020:4670 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-1722 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2020-4670.html · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2020:4670 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2020:4670 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-1722 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2020-3936.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-1722 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-1722 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-1722 · Vendor Advisory