freeipa

#8268 Prevent use of too long passwords
Closed: fixed by abbra. Opened by abbra.

Closed: fixed
Reopen Issue

NIST SP 800-63-3B sets a recommendation to have password length upper bound limited in A.2:

https://pages.nist.gov/800-63-3/sp800-63b.html#appA

Users should be encouraged to make their passwords as lengthy as they
want, within reason. Since the size of a hashed password is independent
of its length, there is no reason not to permit the use of lengthy
passwords (or pass phrases) if the user wishes. Extremely long passwords
(perhaps megabytes in length) could conceivably require excessive
processing time to hash, so it is reasonable to have some limit.

FreeIPA already applied 256 characters limit for non-random passwords set through ipa-getkeytab tool. The limit was not, however, enforced in other places.

MIT Kerberos limits the length of the password to 1024 characters in its tools. However, these tools (kpasswd and 'cpw' command of kadmin) do not differentiate between a password larger than 1024 and a password of 1024 characters. As a result, longer passwords are silently cut off.

To prevent silent cut off for user passwords, use limit of 1000 characters.

This issue was rated as a low severity CVE by Red Hat's Security Response Team: https://bugzilla.redhat.com/CVE-2020-1722.

Metadata Update from @abbra:
- Issue assigned to abbra

Metadata Update from @abbra:
- Custom field changelog adjusted to Kerberos tools limit password entered in kpasswd or kadmin tools to 1024 characters but do not allow to distinguish between passwords cut off at 1024 characters and passwords with 1024 characters. Thus, a limit of 1000 characters is now applied everywhere in FreeIPA.

master:

  • dbf5df4a66b68f62a9e063c43a30b46e539c603b CVE-2020-1722: prevent use of too long passwords

ipa-4-8:

  • 089a393581aa249ddec66ce1455fff4951cdb827 CVE-2020-1722: prevent use of too long passwords

ipa-4-6:

  • a05ebcf9fe63eaebddb2b76d3556814440fe1a86 Add interactive prompt for the LDAP bind password to ipa-getkeytab
  • 972e7200a57195347625e00ea64584d935a3cb92 CVE-2020-1722: prevent use of too long passwords

Metadata Update from @abbra:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
Kerberos tools limit password entered in kpasswd or kadmin tools to 1024 characters but do not allow to distinguish between passwords cut off at 1024 characters and passwords with 1024 characters. Thus, a limit of 1000 characters is now applied everywhere in FreeIPA.
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.