CVE-2019-14867: Vulnerability in IPA Package
Summary
CVE-2019-14867: A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way the internal function ber_scanf() was used in some components of the IPA server, w... Affects ipa across 3 version ranges.
>= 4.6.2, < 4.6.7
>= 4.7.0, < 4.7.4
>= 4.8.0, < 4.8.3
Fixed in 4.6.7, 4.7.4 or 4.8.3, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2019-14867 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The IPA package is an open-source software solution that provides identity, policy, and audit services. It is commonly used for managing user accounts, authentication, and authorization in Linux environments. The package includes various components, including the IPA server, which is responsible for handling Kerberos key data.
Vulnerability Detail
A flaw has been discovered in IPA versions 4.6.x before 4.6.7, 4.7.x before 4.7.4, and 4.8.x before 4.8.3. The vulnerability lies in the ber_scanf() function used in certain components of the IPA server. This function is responsible for parsing Kerberos key data. An attacker without authentication can exploit this flaw by triggering the parsing of the krb principal key. As a result, the IPA server may crash or, under certain conditions, execute arbitrary code on the server hosting the IPA server.
How To Fix
Latest published version: 4.13.1 as of 23 Oct 2026
pip install --upgrade "ipa==4.13.1"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 4.6.2, < 4.6.74.6.7pip install --upgrade "ipa==4.6.7" -
>= 4.7.0, < 4.7.44.7.4pip install --upgrade "ipa==4.7.4" -
>= 4.8.0, < 4.8.34.8.3pip install --upgrade "ipa==4.8.3"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the patched versions of the IPA package.
Conclusion
In conclusion, the IPA package is vulnerable to a flaw that can be exploited by an unauthenticated attacker to crash the server or execute arbitrary code. It is highly recommended to upgrade to the patched versions of the IPA package to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ipa →
FAQ
IPA stands for Identity, Policy, and Audit. It is an open-source software solution used for managing user accounts, authentication, and authorization in Linux environments.
An unauthenticated attacker can exploit this vulnerability to crash the IPA server or execute arbitrary code on the server hosting the IPA server.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. It requires no signup and uses Pipfile.lock to monitor and alert in real-time for open-source vulnerabilities.
No, there are no known workarounds for this vulnerability. It is crucial to upgrade to the patched versions of the IPA package.
You can find more information about this vulnerability in the advisory database at https://github.com/pypa/advisory-database/blob/main/vulns/ipa/PYSEC-2019-28.yaml
Related vulnerabilities
Recent vulnerabilities recorded for ipa.
