Information Exposure Affecting ipa package, versions [,4.6.7) [4.7.0,4.7.4) [4.8.0,4.8.3)


Severity

Recommended
0.0
medium
0
10

CVSS assessment made by Snyk's Security Team

    Threat Intelligence

    EPSS
    0.13% (49th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-PYTHON-IPA-1569606
  • published 25 Aug 2021
  • disclosed 27 Nov 2019
  • credit Unknown

How to fix?

Upgrade ipa to version 4.6.7, 4.7.4, 4.8.3 or higher.

Overview

ipa is an integrated security information management solution.

Affected versions of this package are vulnerable to Information Exposure. The way that FreeIPA's batch processing API logged operations included passing user passwords in clear text on FreeIPA masters. Batch processing of commands with passwords as arguments or options is not performed by default in FreeIPA but is possible by third-party components. An attacker having access to system logs on FreeIPA masters could use this flaw to produce log file content with passwords exposed.

CVSS Scores

version 3.1
Expand this section

Snyk

Recommended
5.3 medium
  • Attack Vector (AV)
    Network
  • Attack Complexity (AC)
    Low
  • Privileges Required (PR)
    None
  • User Interaction (UI)
    None
  • Scope (S)
    Unchanged
  • Confidentiality (C)
    Low
  • Integrity (I)
    None
  • Availability (A)
    None
Expand this section

NVD

6.5 medium