p PatchFirst

CVE-2017-12169

CVE-2017-12169

This page contains facts from public vulnerability sources. Check the original advisory before updating.

It was found that FreeIPA 4.2.0 and later could disclose password hashes to users having the 'System: Read Stage Users' permission. A remote, authenticated attacker could potentially use this flaw to disclose the password hashes belonging to Stage Users. This security issue does not result in disclosure of password hashes belonging to active standard users. NOTE: some developers feel that this report is a suggestion for a design change to Stage User activation, not a statement of a vulnerability.

CVSS 7.5 · High · EPSS 1.9%

Published
Updated

Stack: system

Affected products and versions

  • ipa

    Versions
    • 4.2.0 and later: Affected

    No fix published

  • freeipa Debian:12

    Versions
    • 4.10.1+dfsg1-1+exp1
    • 4.10.1-1+exp1
    • 4.10.2-1
    • 4.10.2-2
    • 4.10.2-2+exp1
    • 4.11.1-1
    • 4.11.1-1+exp1
    • 4.11.1-2
    • 4.11.1-2+exp1
    • 4.11.1-2.1
    • 4.12.2-1
    • 4.12.2-2
    • 4.12.2-3
    • 4.12.4-1
    • 4.12.4-2
    • 4.13.1-1
    • 4.9.11-1
    • 4.9.11-1+exp1
    • 4.9.11-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • freeipa Debian:13

    Versions
    • 4.12.4-1
    • 4.12.4-2
    • 4.13.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • freeipa Ubuntu:Pro:14.04:LTS

    Versions
    • 3.2.1-0ubuntu1
    • 3.3.4-0ubuntu1
    • 3.3.4-0ubuntu2
    • 3.3.4-0ubuntu3
    • 3.3.4-0ubuntu3.1
    • 3.3.4-0ubuntu3.1+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • freeipa Ubuntu:Pro:16.04:LTS

    Versions
    • 4.1.4-1
    • 4.3.1-0ubuntu1
    • 4.3.1-0ubuntu1+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • freeipa Ubuntu:18.04:LTS

    Versions
    • 4.4.4-3ubuntu1
    • 4.4.4-4
    • 4.7.0~pre1+git20180411-2ubuntu1
    • 4.7.0~pre1+git20180411-2ubuntu2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • freeipa Ubuntu:20.04:LTS

    Versions
    • 4.8.1-2ubuntu1
    • 4.8.3-1
    • 4.8.6-1ubuntu2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • freeipa Ubuntu:22.04:LTS

    Versions
    • 4.8.6-1ubuntu6
    • 4.8.6-1ubuntu8
    • 4.8.6-1ubuntu9
    • 4.9.8-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • freeipa Ubuntu:24.04:LTS

    Versions
    • 4.10.2-1
    • 4.10.2-2
    • 4.10.2-2ubuntu3
    • 4.11.1-1
    • 4.11.1-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • freeipa Ubuntu:25.10

    Versions
    • 4.12.2-3
    • 4.12.4-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • freeipa Ubuntu:26.10

    Versions
    • 4.13.1-1
    • 4.13.1-1build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • freeipa Ubuntu:26.04:LTS

    Versions
    • 4.12.4-1
    • 4.12.4-2
    • 4.13.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →