PT-2025-1618 · Freeipa+4 · Freeipa+4

Published 2025-01-15 · Updated 2025-01-27 · CVE-2024-11029

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions FreeIPA (affected versions not specified)

Description A flaw was found in the FreeIPA API audit, where it sends the whole FreeIPA command line to journalctl. As a consequence, during the FreeIPA installation process, it inadvertently leaks the administrative user credentials, including the administrator password, to the journal database. In the worst-case scenario, where the journal log is centralized, users with access to it can have improper access to the FreeIPA administrator credentials.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-497

Related Identifiers

ALSA-2025:0334

ALT-PU-2025-1448

ALT-PU-2025-1456

ALT-PU-2025-1651

BDU:2026-06677

CVE-2024-11029

INFSA-2025_0334

RHSA-2025:0334

RHSA-2025_0334

Affected Products

Alt Linux

Almalinux

Debian

Freeipa

Red Hat

References · 23

• https://nvd.nist.gov/vuln/detail/CVE-2024-11029 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2024-11029 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-06677 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-11029 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2025-0334.html · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2025:0334 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-11029 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-11029 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2025:0334 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2026-0518SE47 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-11029 · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2025-0334.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-11029 · Security Note
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2026-0421SE17 · Vendor Advisory
• https://altsp.su/obnovleniya-bezopasnosti · Note