CVE-2019-14867: Code injection in FreeIPA
Summary
CVE-2019-14867: Code injection in FreeIPA. Affects ipa across 3 version ranges.
>= 4.6.2, < 4.6.7
>= 4.7.0, < 4.7.4
>= 4.8.0, < 4.8.3
Fixed in 4.6.7, 4.7.4 or 4.8.3, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2019-14867 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FreeIPA is an open-source identity management system that provides centralized authentication, authorization, and account information by combining various technologies such as LDAP, Kerberos, and DNS. It is widely used in enterprise environments to manage user identities and access control. However, a vulnerability has been discovered in FreeIPA versions 4.6.x before 4.6.7, 4.7.x before 4.7.4, and 4.8.x before 4.8.3.
Vulnerability Detail
The vulnerability stems from the improper usage of the internal function ber_scanf() in certain components of the IPA server. This function is responsible for parsing Kerberos key data. An attacker, without authentication, can exploit this flaw by triggering the parsing of the krb principal key. As a result, the IPA server may crash or, under certain conditions, execute arbitrary code on the server hosting the IPA server. This can lead to a complete compromise of the system and unauthorized access to sensitive information.
How To Fix
Latest published version: 4.13.1 as of 23 Oct 2026
pip install --upgrade "ipa==4.13.1"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 4.6.2, < 4.6.74.6.7pip install --upgrade "ipa==4.6.7" -
>= 4.7.0, < 4.7.44.7.4pip install --upgrade "ipa==4.7.4" -
>= 4.8.0, < 4.8.34.8.3pip install --upgrade "ipa==4.8.3"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the patched versions of FreeIPA.
Conclusion
In conclusion, the discovered code injection vulnerability in FreeIPA can lead to severe consequences, including unauthorized access and arbitrary code execution. It is highly recommended to upgrade to the patched versions of FreeIPA to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ipa →
FAQ
FreeIPA is an open-source identity management system that provides centralized authentication, authorization, and account information.
The vulnerability affects FreeIPA versions 4.6.x before 4.6.7, 4.7.x before 4.7.4, and 4.8.x before 4.8.3.
An attacker can exploit this vulnerability by triggering the parsing of the krb principal key, which can lead to a crash of the IPA server or execution of arbitrary code.
The potential consequences include a complete compromise of the system, unauthorized access to sensitive information, and the execution of arbitrary code on the server hosting the IPA server.
No, there is no known workaround for this vulnerability. It is crucial to upgrade to the patched versions of FreeIPA.
Related vulnerabilities
Recent vulnerabilities recorded for ipa.
