Upstream information
CVE-2025-7493 at MITRE
Description
A privilege escalation flaw from host to domain administrator was found in FreeIPA. This vulnerability is similar to CVE-2025-4404, where it fails to validate the uniqueness of the krbCanonicalName. While the previously released version added validations for the admin@REALM credential, FreeIPA still does not validate the root@REALM canonical name, which can also be used as the realm administrator's name. This flaw allows an attacker to perform administrative tasks over the REALM, leading to access to sensitive data and sensitive data exfiltration.
Other Security Trackers
Overall state of this security issue: Resolved
This issue is currently rated as having critical severity.
CVSS v3 Scores
CVSS detail | CNA (Red Hat) |
Base Score | 9.1 |
Vector | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
Attack Vector | Network |
Attack Complexity | Low |
Privileges Required | High |
User Interaction | None |
Scope | Changed |
Confidentiality Impact | High |
Integrity Impact | High |
Availability Impact | High |
CVSSv3 Version | 3.1 |
No SUSE Bugzilla entries cross referenced.
SUSE Security Advisories:
List of released packages
Product(s) | Fixed package version(s) | References |
SUSE Liberty Linux 8 | bind-dyndb-ldap >= 11.6-6.module+el8.10.0+23009+91fb337e
custodia >= 0.6.0-3.module+el8.9.0+18911+94941f82
ipa-client >= 4.9.13-20.module+el8.10.0+23537+32c82745
ipa-client-common >= 4.9.13-20.module+el8.10.0+23537+32c82745
ipa-client-epn >= 4.9.13-20.module+el8.10.0+23537+32c82745
ipa-client-samba >= 4.9.13-20.module+el8.10.0+23537+32c82745
ipa-common >= 4.9.13-20.module+el8.10.0+23537+32c82745
ipa-healthcheck >= 0.12-6.module+el8.10.0+23403+cc1f9b40
ipa-healthcheck-core >= 0.12-6.module+el8.10.0+23404+f6b3454f
ipa-python-compat >= 4.9.13-20.module+el8.10.0+23537+32c82745
ipa-selinux >= 4.9.13-20.module+el8.10.0+23537+32c82745
ipa-server >= 4.9.13-20.module+el8.10.0+23534+744f3864
ipa-server-common >= 4.9.13-20.module+el8.10.0+23534+744f3864
ipa-server-dns >= 4.9.13-20.module+el8.10.0+23534+744f3864
ipa-server-trust-ad >= 4.9.13-20.module+el8.10.0+23534+744f3864
opendnssec >= 2.1.7-2.module+el8.10.0+22913+7aa1a207
python3-custodia >= 0.6.0-3.module+el8.9.0+18911+94941f82
python3-ipaclient >= 4.9.13-20.module+el8.10.0+23537+32c82745
python3-ipalib >= 4.9.13-20.module+el8.10.0+23537+32c82745
python3-ipaserver >= 4.9.13-20.module+el8.10.0+23534+744f3864
python3-ipatests >= 4.9.13-20.module+el8.10.0+23534+744f3864
python3-jwcrypto >= 0.5.0-2.module+el8.10.0+21692+c9b201bc
python3-kdcproxy >= 0.4-5.module+el8.10.0+22564+098ba143.1
python3-pyusb >= 1.0.0-9.1.module+el8.9.0+18920+2223d05e
python3-qrcode >= 5.3-1.module+el8.10.0+22544+6a7f07c2
python3-qrcode-core >= 5.3-1.module+el8.10.0+22544+6a7f07c2
python3-yubico >= 1.3.2-9.1.module+el8.9.0+18920+2223d05e
slapi-nis >= 0.60.0-4.module+el8.10.0+20723+03062ebd
softhsm >= 2.6.0-5.module+el8.9.0+18911+94941f82
softhsm-devel >= 2.6.0-5.module+el8.9.0+18911+94941f82
| Patchnames: ESSA-2025:3454 ESSA-2025:3455 |
SUSE Liberty Linux 9 | ipa-client >= 4.12.2-14.el9_6.5
ipa-client-common >= 4.12.2-14.el9_6.5
ipa-client-encrypted-dns >= 4.12.2-14.el9_6.5
ipa-client-epn >= 4.12.2-14.el9_6.5
ipa-client-samba >= 4.12.2-14.el9_6.5
ipa-common >= 4.12.2-14.el9_6.5
ipa-selinux >= 4.12.2-14.el9_6.5
ipa-selinux-luna >= 4.12.2-14.el9_6.5
ipa-selinux-nfast >= 4.12.2-14.el9_6.5
ipa-server >= 4.12.2-14.el9_6.5
ipa-server-common >= 4.12.2-14.el9_6.5
ipa-server-dns >= 4.12.2-14.el9_6.5
ipa-server-encrypted-dns >= 4.12.2-14.el9_6.5
ipa-server-trust-ad >= 4.12.2-14.el9_6.5
python3-ipaclient >= 4.12.2-14.el9_6.5
python3-ipalib >= 4.12.2-14.el9_6.5
python3-ipaserver >= 4.12.2-14.el9_6.5
python3-ipatests >= 4.12.2-14.el9_6.5
| Patchnames: RHSA-2025:17084 |
SUSE Timeline for this CVE
CVE page created: Tue Sep 30 18:00:07 2025
CVE page last modified: Mon Oct 6 20:04:51 2025