CVE-2019-14867
HIGH
8,8
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: required
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: high
MEDIUM
6,8
Source: [email protected]
Access Vector: network
Access Complexity: medium
Authentication: none
Confidentiality: partial
Integrity: partial
Availability: partial
Description
AI Translation Available
A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way the internal function ber_scanf() was used in some components of the IPA server, which parsed kerberos key data. An unauthenticated attacker who could trigger parsing of the krb principal key could cause the IPA server to crash or in some conditions, cause arbitrary code to be executed on the server hosting the IPA server.
EPSS (Exploit Prediction Scoring System)
Trend Analysis
EPSS (Exploit Prediction Scoring System)
Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.
EPSS Score
0,0261
Percentile
0,9th
Updated
EPSS Score Trend (Last 91 Days)
94
Improper Control of Generation of Code ('Code Injection')
DraftCommon Consequences
Security Scopes Affected:
Access Control
Integrity
Confidentiality
Availability
Non-Repudiation
Potential Impacts:
Bypass Protection Mechanism
Gain Privileges Or Assume Identity
Execute Unauthorized Code Or Commands
Hide Activities
Applicable Platforms
Languages:
Interpreted
Technologies:
AI/ML
400
Uncontrolled Resource Consumption
DraftCommon Consequences
Security Scopes Affected:
Availability
Access Control
Other
Potential Impacts:
Dos: Crash, Exit, Or Restart
Dos: Resource Consumption (Cpu)
Dos: Resource Consumption (Memory)
Dos: Resource Consumption (Other)
Bypass Protection Mechanism
Other
Applicable Platforms
All platforms may be affected
Application
Freeipa by Freeipa
Version Range Affected
From
4.6.0
(inclusive)
To
4.6.7
(exclusive)
CPE Identifier
View Detailed Analysis
cpe:2.3:a:freeipa:freeipa:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application
Freeipa by Freeipa
Version Range Affected
From
4.7.0
(inclusive)
To
4.7.4
(exclusive)
CPE Identifier
View Detailed Analysis
cpe:2.3:a:freeipa:freeipa:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System
Fedora by Fedoraproject
CPE Identifier
View Detailed Analysis
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System
Fedora by Fedoraproject
CPE Identifier
View Detailed Analysis
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application
Freeipa by Freeipa
Version Range Affected
From
4.8.0
(inclusive)
To
4.8.3
(exclusive)
CPE Identifier
View Detailed Analysis
cpe:2.3:a:freeipa:freeipa:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
https://access.redhat.com/errata/RHBA-2019:4268
https://access.redhat.com/errata/RHSA-2020:0378
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14867
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapr…
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapr…
https://www.freeipa.org/page/Releases/4.6.7
https://www.freeipa.org/page/Releases/4.7.4
https://www.freeipa.org/page/Releases/4.8.3
https://access.redhat.com/errata/RHBA-2019:4268
https://access.redhat.com/errata/RHSA-2020:0378
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14867
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapr…
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapr…
https://www.freeipa.org/page/Releases/4.6.7
https://www.freeipa.org/page/Releases/4.7.4
https://www.freeipa.org/page/Releases/4.8.3