CVE-2019-10195: FreeIPA Logs Passwords in Clear Text
Summary
CVE-2019-10195: FreeIPA logs passwords embedded in commands in calls using batch. Affects freeipa across 3 version ranges.
>= 4.6.0, < 4.6.7
>= 4.7.0, < 4.7.4
>= 4.8.0, < 4.8.3
Fixed in 4.6.7, 4.7.4 or 4.8.3, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2019-10195 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FreeIPA is an open-source identity management system that provides centralized authentication, authorization, and account information by combining various technologies such as LDAP, Kerberos, and DNS. It is designed to simplify the management of user accounts and systems in a network environment. However, a vulnerability has been discovered in FreeIPA versions 4.6.x, 4.7.x, and 4.8.x that exposes passwords in clear text in system logs.
Vulnerability Detail
The vulnerability in FreeIPA's batch processing API allows user passwords to be logged in clear text on FreeIPA masters. Although batch processing of commands with passwords is not performed by default in FreeIPA, it can be enabled by third-party components. An attacker with access to system logs on FreeIPA masters could exploit this flaw to obtain passwords exposed in the log files. This poses a significant security risk as it compromises the confidentiality of user passwords.
How To Fix
Latest published version: 4.13.1 as of 23 Oct 2026
pip install --upgrade "freeipa==4.13.1"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 4.6.0, < 4.6.74.6.7pip install --upgrade "freeipa==4.6.7" -
>= 4.7.0, < 4.7.44.7.4pip install --upgrade "freeipa==4.7.4" -
>= 4.8.0, < 4.8.34.8.3pip install --upgrade "freeipa==4.8.3"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, it is recommended to disable batch processing of commands with passwords in FreeIPA. This can be achieved by ensuring that third-party components or custom configurations do not enable this functionality. Additionally, monitoring and restricting access to system logs can help mitigate the risk of password exposure.
Conclusion
The vulnerability in FreeIPA that logs passwords in clear text poses a significant security risk. It is crucial to upgrade to the fixed versions and secure system logs to prevent unauthorized access to sensitive information. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for freeipa →
FAQ
FreeIPA is an open-source identity management system that provides centralized authentication, authorization, and account information.
The vulnerability affects FreeIPA versions 4.6.x, 4.7.x, and 4.8.x.
An attacker with access to system logs on FreeIPA masters can exploit this vulnerability to obtain passwords exposed in the log files.
Upgrading FreeIPA to the fixed versions (4.6.7, 4.7.4, or 4.8.3) and securing system logs can help mitigate the risk of password exposure.
No, batch processing of commands with passwords is not performed by default in FreeIPA. It can be enabled by third-party components.
Related vulnerabilities
Recent vulnerabilities recorded for freeipa.
