Homepage

Incorrect Authorization The advisory has been revoked - it doesn't affect any version of package freeipa  (opens in a new tab)

Threat Intelligence

EPSS
0.67% (47th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIAN14-FREEIPA-11743477
  • published10 Aug 2025
  • disclosed12 Jun 2024
Report a new vulnerability Found a mistake?

Introduced: 12 Jun 2024

CVE-2024-2698  (opens in a new tab)
CWE-863  (opens in a new tab)

Amendment

The Debian security team deemed this advisory irrelevant for Debian:14.

NVD Description

Note: Versions mentioned in the description apply only to the upstream freeipa package and not the freeipa package as distributed by Debian.

A vulnerability was found in FreeIPA in how the initial implementation of MS-SFU by MIT Kerberos was missing a condition for granting the "forwardable" flag on S4U2Self tickets. Fixing this mistake required adding a special case for the check_allowed_to_delegate() function: If the target service argument is NULL, then it means the KDC is probing for general constrained delegation rules and not checking a specific S4U2Proxy request.

In FreeIPA 4.11.0, the behavior of ipadb_match_acl() was modified to match the changes from upstream MIT Kerberos 1.20. However, a mistake resulting in this mechanism applies in cases where the target service argument is set AND where it is unset. This results in S4U2Proxy requests being accepted regardless of whether or not there is a matching service delegation rule.