CVE-2019-10195 FreeIPA logs passwords embedded in commands in calls using batch
Attackers with log access can read clear-text passwords exposed by FreeIPA's batch processing API, which is disabled by default but enabled by third-party components.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2019-10195?
CVE-2019-10195 is a medium-severity vulnerability in Fedoraproject Fedora, published on 27 Nov 2019. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way that FreeIPA's batch processing API logged operations. This included passing user passwords in clear text on FreeIPA masters. Batch processing of commands with passwords as arguments or options is not performed by default in FreeIPA but is possible by third-party components. An attacker having access to system logs on FreeIPA masters could use this flaw to produce log file content with passwords exposed.
Which versions are affected by CVE-2019-10195?
14 open source packages ship an affected version, including freeipa and ipa. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
freeipa PyPI | From 4.6.0 | 4.6.7 |
freeipa PyPI | From 4.6.0 | 4.6.7 |
freeipa PyPI | From 4.6.1 | 4.6.7, 4.7.4, 4.8.3 |
freeipa PyPI | From 4.7.0 | 4.7.4 |
freeipa PyPI | From 4.7.0 | 4.7.4 |
freeipa PyPI | From 4.8.0 | 4.8.3 |
8 more packages
freeipa PyPI | From 4.8.0 | 4.8.3 |
ipa PyPI | From 4.6.0 | 4.6.7, 4.7.4, 4.8.3 |
ipa PyPI | From 4.6.0 | 4.6.7 |
ipa PyPI | From 4.6.0 | 4.6.7 |
ipa PyPI | From 4.7.0 | 4.7.4 |
ipa PyPI | From 4.7.0 | 4.7.4 |
ipa PyPI | From 4.8.0 | 4.8.3 |
ipa PyPI | From 4.8.0 | 4.8.3 |
Products include Fedoraproject Fedora, Freeipa Freeipa.
How do I fix CVE-2019-10195?
Upgrade freeipa to a fixed version for your release line: 4.6.7, 4.7.4 or 4.8.3.
Is CVE-2019-10195 being exploited?
There is no known exploitation of CVE-2019-10195 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as DEBIAN-CVE-2019-10195, GHSA-w4q7-f34x-vpgc, PYSEC-2019-168, PYSEC-2019-22, UBUNTU-CVE-2019-10195.