Privilege Escalation Vulnerability in ipa-client and Related Packages
Summary
ALSA-2025:20994: Important: ipa security update. Affects ipa-client versions < 4.12.2-24.el10_1.1. Fixed in 4.12.2-24.el10_1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
AlmaLinux Identity Management (IdM) is a centralized solution for authentication, identity management, and authorization, catering to both traditional and cloud-based enterprise environments. The ipa-client package is integral to this system, facilitating client-side interactions with the IdM server. This vulnerability affects multiple related packages, including ipa-client-common, ipa-server, and others, which are essential for the proper functioning of the IdM ecosystem.
Vulnerability Detail
The vulnerability identified as CVE-2025-7493 allows for privilege escalation from a host to a domain admin within FreeIPA. This flaw could enable unauthorized users to gain elevated privileges, potentially compromising the integrity and security of the entire identity management system. The issue arises from improper handling of permissions, which could be exploited by malicious actors to perform unauthorized actions.
How To Fix
Minimum fixed version
4.12.2-24.el10_1.1
This is the first release that contains the fix.
sudo dnf update ipa-clientTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider restricting access to the affected services and monitoring for any unusual activity until the packages can be updated. Implementing strict access controls can help mitigate the risk of exploitation.
Conclusion
The identified vulnerability in the ipa-client and related packages poses a significant risk of privilege escalation within the AlmaLinux Identity Management system. It is imperative to update to the patched version to safeguard against potential exploitation. Regular monitoring and updates are essential for maintaining system security.
See every vulnerability recorded for ipa-client →
FAQ
CVE-2025-7493 is a vulnerability in FreeIPA that allows privilege escalation from a host to a domain admin.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability could allow unauthorized users to gain elevated privileges, potentially compromising the security of your identity management system.
It is recommended to regularly check for updates and apply them promptly to ensure your system is protected against known vulnerabilities.
Vulert is a service that monitors and alerts in real-time for open-source vulnerabilities in software using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for ipa-client.
