Critical Credential Leak in FreeIPA API Audit
Summary
CVE-2024-11029: A flaw was found in the FreeIPA API audit, where it sends the whole FreeIPA command line to journalctl. Affects freeipa versions 4.10.1+dfsg1-1+exp1 – 4.9.11-2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FreeIPA is an integrated security information management solution that provides centralized authentication, authorization, and account information by managing identities and policies. It is widely used in enterprise environments to streamline user management and enhance security. However, a recent vulnerability has been identified in its API audit functionality, which poses a significant risk to administrative credentials.
Vulnerability Detail
A flaw was found in the FreeIPA API audit, where it sends the entire FreeIPA command line to journalctl. This behavior leads to the inadvertent leakage of administrative user credentials, including the administrator password, during the installation process. If the journal logs are centralized, unauthorized users with access to these logs can gain improper access to sensitive FreeIPA administrator credentials, potentially leading to unauthorized system access and administrative control.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider disabling the logging of command lines to journalctl during the FreeIPA installation process. This can be done by modifying the logging configuration to exclude sensitive information. However, this is not a permanent solution and should be followed by applying the patch as soon as it is available.
Conclusion
The CVE-2024-11029 vulnerability in FreeIPA poses a serious risk by leaking administrative credentials through journal logs. It is crucial for users to update their installations to the patched version as soon as it is available and to consider temporary workarounds to mitigate the risk in the meantime.
See every vulnerability recorded for freeipa →
FAQ
CVE-2024-11029 is a vulnerability in the FreeIPA API audit that exposes administrative user credentials through journalctl logs.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The primary risk is unauthorized access to FreeIPA administrative credentials, which can lead to compromised systems and data breaches.
Yes, a patched version of the FreeIPA package is expected to be released. Users should update their installations as soon as it becomes available.
If you cannot apply the patch right away, implement the suggested workaround to minimize the risk of credential exposure.
Related vulnerabilities
Recent vulnerabilities recorded for freeipa.
