p PatchFirst

CVE-2016-9575

CVE-2016-9575

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Ipa versions 4.2.x, 4.3.x before 4.3.3 and 4.4.x before 4.4.3 did not properly check the user's permissions while modifying certificate profiles in IdM's certprofile-mod command. An authenticated, unprivileged attacker could use this flaw to modify profiles to issue certificates with arbitrary naming or key usage information and subsequently use such certificates for other attacks.

CVSS 6.3 · Medium · EPSS 0.8% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • ipa

    Versions
    • 4.2.x: Affected
    • 4.3.x before 4.3.3: Affected
    • 4.4.x before 4.4.3: Affected

    No fix published

  • freeipa Debian:12

    Affected ranges
    • ECOSYSTEM: < 4.4.4-1

    Update to 4.4.4-1

  • freeipa Debian:13

    Affected ranges
    • ECOSYSTEM: < 4.4.4-1

    Update to 4.4.4-1

  • freeipa Ubuntu:Pro:16.04:LTS

    Versions
    • 4.1.4-1
    • 4.3.1-0ubuntu1
    Affected ranges
    • ECOSYSTEM: < 4.3.1-0ubuntu1+esm1

    Update to 4.3.1-0ubuntu1+esm1

Original sources

Check your server →