freeipa

#9541 specially crafted HTTP requests potentially lead to DoS or data exposure
Closed: fixed by frenaud. Opened by rcritten.

Closed: fixed
Reopen Issue

Issue

The "user" parameter in the HTTP URI "/sip/session/login_password" is inserted into the "run" function from the file "ipautil.py". Then it is passed as an argument to the "subprocess.Popen". As a result, the following list is passed: "args=['/usr/bin/kinit', '{user params}', '-c', /run/ipa/ccaches/kinit_13704', '-T', '/run/ipa/ccaches/armor_13704', '-C', '-E']". If instead of "{user params}" there is a string "-V", then it will be taken as an argument for "kinit". As a result, remote attackers can use options such as "-t", "-X", "-S" or "-I" for DOS, or use the keytab file from the system to log in under participants without a password.

Simple request with "user=-H&password=0000000"
With multiple parameters "user=-Vkt&password=0000000"

Cloned from https://bugzilla.redhat.com/show_bug.cgi?id=2262169

Metadata Update from @rcritten:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=2265129

Metadata Update from @rcritten:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=2265129 https://issues.redhat.com/browse/FREEIPA-10792 (was: https://bugzilla.redhat.com/show_bug.cgi?id=2265129 )

master:

  • 404fe1018e08e546fd14c83741e00b900c1cd208 rpcserver: validate Kerberos principal name before running kinit

master:

  • 33af154b7f2c92e199d10a36a48310da9b7e77a8 validate_principal: Don't try to verify that the realm is known

Metadata Update from @frenaud:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=2265129 https://issues.redhat.com/browse/FREEIPA-10792, https://issues.redhat.com/browse/RHEL-26154, https://issues.redhat.com/browse/RHEL-26153 (was: https://bugzilla.redhat.com/show_bug.cgi?id=2265129 https://issues.redhat.com/browse/FREEIPA-10792)

ipa-4-11:

  • 8b598814d1e51466ebbe3e0a392af92370d0c93b rpcserver: validate Kerberos principal name before running kinit
  • 5781369e78fd83cee64a4d306198423c7a126ba0 validate_principal: Don't try to verify that the realm is known

ipa-4-10:

  • 921661fd460799da69043e06e058cff75a64ce3c rpcserver: validate Kerberos principal name before running kinit
  • 204011dc0514681511275a4b70a13bfa85c1a538 validate_principal: Don't try to verify that the realm is known

ipa-4-9:

  • b039f3087a13de3f34b230dbe29a7cfb1965700d rpcserver: validate Kerberos principal name before running kinit
  • 96a478bbedd49c31e0f078f00f2d1cb55bb952fd validate_principal: Don't try to verify that the realm is known

ipa-4-6:

  • 09c3b322aa9d942bc3e04a725323821d19bac0eb rpcserver: validate Kerberos principal name before running kinit
  • e4628c4573661afb10bdc81f8739e7004849d246 validate_principal: Don't try to verify that the realm is known

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

ipa-4-6:

  • a84db9a254f8955151e84bc0c8c438f0e06c9e27 validate_principal: Fix python2 issues
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.