Privilege Escalation Vulnerability in ipa-client and Related Packages
Summary
ALSA-2025:17084: Important: ipa security update. Affects ipa-client versions < 4.12.2-14.el9_6.5. Fixed in 4.12.2-14.el9_6.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
AlmaLinux Identity Management (IdM) is a centralized solution for authentication, identity management, and authorization, catering to both traditional and cloud-based enterprise environments. The ipa-client package is crucial for enabling client machines to interact with the IdM server, providing essential services such as user authentication and access control. This package, along with its related components, is integral to maintaining secure and efficient identity management within an organization.
Vulnerability Detail
The vulnerability identified as CVE-2025-7493 allows for privilege escalation from host to domain admin within FreeIPA. This means that an attacker with access to a host could potentially gain elevated privileges, compromising the security of the entire identity management system. The implications of this vulnerability are severe, as it could lead to unauthorized access to sensitive data and administrative controls, thereby undermining the integrity of the identity management framework.
How To Fix
Minimum fixed version
4.12.2-14.el9_6.5
This is the first release that contains the fix.
sudo dnf update ipa-clientTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider restricting access to the affected systems and monitoring for any suspicious activity. Additionally, ensure that only trusted users have access to the host systems until the patch can be applied.
Conclusion
The privilege escalation vulnerability in the ipa-client and related packages poses a significant risk to the security of AlmaLinux Identity Management systems. It is crucial to apply the necessary updates to mitigate this risk and ensure the integrity of your identity management framework. Regular monitoring and timely updates are essential in maintaining a secure environment.
See every vulnerability recorded for ipa-client →
FAQ
CVE-2025-7493 is a vulnerability that allows privilege escalation from host to domain admin in FreeIPA, potentially compromising the security of the identity management system.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, restrict access to affected systems and monitor for unusual activities as a temporary workaround.
Failing to address this vulnerability could lead to unauthorized access, data breaches, and a complete compromise of the identity management system.
For more details, refer to the CVE page associated with CVE-2025-7493 and the AlmaLinux advisories.
Related vulnerabilities
Recent vulnerabilities recorded for ipa-client.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
