Upstream information
Description
A privilege escalation flaw from host to domain administrator was found in FreeIPA. This vulnerability is similar to CVE-2025-4404, where it fails to validate the uniqueness of the krbCanonicalName. While the previously released version added validations for the admin@REALM credential, FreeIPA still does not validate the root@REALM canonical name, which can also be used as the realm administrator's name. This flaw allows an attacker to perform administrative tasks over the REALM, leading to access to sensitive data and sensitive data exfiltration.Other Security Trackers
SUSE information
Overall state of this security issue: Resolved
This issue is currently rated as having critical severity.
CNA (Red Hat) | |
---|---|
Base Score | 9.1 |
Vector | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
Attack Vector | Network |
Attack Complexity | Low |
Privileges Required | High |
User Interaction | None |
Scope | Changed |
Confidentiality Impact | High |
Integrity Impact | High |
Availability Impact | High |
CVSSv3 Version | 3.1 |
SUSE Security Advisories:
- RHSA-2025:17084, published Wed Oct 1 15:07:45 UTC 2025
List of released packages
Product(s) | Fixed package version(s) | References |
---|---|---|
SUSE Liberty Linux 9 |
| Patchnames: RHSA-2025:17084 |
SUSE Timeline for this CVE
CVE page created: Tue Sep 30 18:00:07 2025CVE page last modified: Wed Oct 1 21:21:48 2025