Upstream information
Description
A privilege escalation from host to domain vulnerability was found in the FreeIPA project. The FreeIPA package fails to validate the uniqueness of the `krbCanonicalName` for the admin account by default, allowing users to create services with the same canonical name as the REALM admin. When a successful attack happens, the user can retrieve a Kerberos ticket in the name of this service, containing the admin@REALM credential. This flaw allows an attacker to perform administrative tasks over the REALM, leading to access to sensitive data and sensitive data exfiltration.Other Security Trackers
SUSE information
Overall state of this security issue: Does not affect SUSE products
This issue is currently rated as having critical severity.
CNA (Red Hat) | |
---|---|
Base Score | 9.1 |
Vector | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
Attack Vector | Network |
Attack Complexity | Low |
Privileges Required | High |
User Interaction | None |
Scope | Changed |
Confidentiality Impact | High |
Integrity Impact | High |
Availability Impact | High |
CVSSv3 Version | 3.1 |
SUSE Security Advisories:
- ESSA-2025:3024, published Fri Jun 20 15:07:18 UTC 2025
- ESSA-2025:3025, published Fri Jun 20 15:07:18 UTC 2025
- RHSA-2025:9184, published Sat Jun 21 15:06:34 UTC 2025
List of released packages
Product(s) | Fixed package version(s) | References |
---|---|---|
SUSE Liberty Linux 8 |
| Patchnames: ESSA-2025:3024 ESSA-2025:3025 |
SUSE Liberty Linux 9 |
| Patchnames: RHSA-2025:9184 |
SUSE Timeline for this CVE
CVE page created: Tue Jun 17 16:00:10 2025CVE page last modified: Tue Jul 29 22:18:17 2025