Critical Security Update for AlmaLinux Identity Management Packages: SSRF and DoS Vulnerabilities
Summary
ALSA-2025:21140: Important: idm:DL1 security update. Affects bind-dyndb-ldap versions < 11.6-6.module_el8.10.0+3980+d78e8e90. Fixed in 11.6-6.module_el8.10.0+3980+d78e8e90. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
AlmaLinux Identity Management (IdM) is a centralized solution for authentication, identity management, and authorization, catering to both traditional and cloud-based enterprise environments. It provides essential services such as user account management, policy enforcement, and secure access control, making it a vital component for organizations relying on secure identity management. However, recent vulnerabilities have been identified that could compromise the integrity and availability of these services.
Vulnerability Detail
The vulnerabilities stem from issues in the python-kdcproxy package. The first vulnerability (CVE-2025-59088) allows unauthenticated Server-Side Request Forgery (SSRF) through a Realm-controlled DNS SRV, which could lead to unauthorized access to internal resources. The second vulnerability (CVE-2025-59089) enables a remote Denial of Service (DoS) attack via unbounded TCP upstream buffering, potentially causing service outages and impacting availability. These vulnerabilities highlight the need for immediate attention to maintain the security posture of affected systems.
How To Fix
Minimum fixed version
11.6-6.module_el8.10.0+3980+d78e8e90
This is the first release that contains the fix.
sudo dnf update bind-dyndb-ldapTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to the affected services and monitor network traffic for unusual activity until the packages are updated. Implementing firewall rules to limit access to the KDC service can also help mitigate the risk.
Conclusion
The vulnerabilities identified in AlmaLinux Identity Management packages pose serious risks that can lead to unauthorized access and service disruptions. It is crucial for users to update their packages to the patched versions as soon as possible to mitigate these risks. Utilizing tools like Vulert can assist in monitoring and managing open-source vulnerabilities effectively.
See every vulnerability recorded for bind-dyndb-ldap →
FAQ
The vulnerabilities include unauthenticated SSRF and remote DoS attacks that can compromise the security and availability of the affected services.
You can use the Vulert platform to check if your application is affected by these vulnerabilities without requiring access to the code or installation.
If immediate updates are not possible, implement temporary workarounds such as restricting access to the affected services.
As of now, there are no public exploits reported, but the vulnerabilities pose significant risks and should be addressed promptly.
Detailed information can be found on the CVE pages for CVE-2025-59088 and CVE-2025-59089.
Related vulnerabilities
Recent vulnerabilities recorded for bind-dyndb-ldap.
