CVE-2025-4404
CVE-2025-4404 · Freeipa: idm: privilege escalation from host to domain admin in freeipa
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
A privilege escalation from host to domain vulnerability was found in the FreeIPA project. The FreeIPA package fails to validate the uniqueness of the `krbCanonicalName` for the admin account by default, allowing users to create services with the same canonical name as the REALM admin. When a successful attack happens, the user can retrieve a Kerberos ticket in the name of this service, containing the admin@REALM credential. This flaw allows an attacker to perform administrative tasks over the REALM, leading to access to sensitive data and sensitive data exfiltration.
CVSS 9.1 · Critical · EPSS 2.0% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
red hat enterprise linux 10
- Versions
- ≥ 0:4.12.2-15.el10_0.1: Not affected (rpm)
No fix published
red hat enterprise linux 7 extended lifecycle support
- Versions
- ≥ 0:4.6.8-5.el7_9.18: Not affected (rpm)
No fix published
red hat enterprise linux 8
- Versions
- ≥ 8100020250603150652.143e9e98: Not affected (rpm)
No fix published
red hat enterprise linux 8
- Versions
- ≥ 8100020250603134209.823393f5: Not affected (rpm)
No fix published
red hat enterprise linux 8.2 advanced update support
- Versions
- ≥ 8020020250609031831.50ea30f9: Not affected (rpm)
No fix published
red hat enterprise linux 8.2 advanced update support
- Versions
- ≥ 8020020250609030144.792f4060: Not affected (rpm)
No fix published
red hat enterprise linux 8.4 advanced mission critical update support
- Versions
- ≥ 8040020250609101903.f153676a: Not affected (rpm)
No fix published
red hat enterprise linux 8.4 advanced mission critical update support
- Versions
- ≥ 8040020250609095221.5b01ab7e: Not affected (rpm)
No fix published
red hat enterprise linux 8.6 advanced mission critical update support
- Versions
- ≥ 8060020250606060927.c1533a64: Not affected (rpm)
No fix published
red hat enterprise linux 8.6 advanced mission critical update support
- Versions
- ≥ 8060020250606060504.ada582f1: Not affected (rpm)
No fix published
red hat enterprise linux 8.6 telecommunications update service
- Versions
- ≥ 8060020250606060927.c1533a64: Not affected (rpm)
No fix published
red hat enterprise linux 8.6 telecommunications update service
- Versions
- ≥ 8060020250606060504.ada582f1: Not affected (rpm)
No fix published
red hat enterprise linux 8.6 update services for sap solutions
- Versions
- ≥ 8060020250606060927.c1533a64: Not affected (rpm)
No fix published
red hat enterprise linux 8.6 update services for sap solutions
- Versions
- ≥ 8060020250606060504.ada582f1: Not affected (rpm)
No fix published
red hat enterprise linux 8.8 telecommunications update service
- Versions
- ≥ 8080020250604195510.e581a9e4: Not affected (rpm)
No fix published
red hat enterprise linux 8.8 telecommunications update service
- Versions
- ≥ 8080020250604202433.b0a6ceea: Not affected (rpm)
No fix published
red hat enterprise linux 8.8 update services for sap solutions
- Versions
- ≥ 8080020250604195510.e581a9e4: Not affected (rpm)
No fix published
red hat enterprise linux 8.8 update services for sap solutions
- Versions
- ≥ 8080020250604202433.b0a6ceea: Not affected (rpm)
No fix published
red hat enterprise linux 9
- Versions
- ≥ 0:4.12.2-14.el9_6.1: Not affected (rpm)
No fix published
red hat enterprise linux 9.0 update services for sap solutions
- Versions
- ≥ 0:4.9.8-11.el9_0.4: Not affected (rpm)
No fix published
red hat enterprise linux 9.2 update services for sap solutions
- Versions
- ≥ 0:4.10.1-12.el9_2.4: Not affected (rpm)
No fix published
red hat enterprise linux 9.4 extended update support
- Versions
- ≥ 0:4.11.0-15.el9_4.5: Not affected (rpm)
No fix published
red hat enterprise linux 6
No fix published
freeipa Debian:12
- Versions
- 4.10.1+dfsg1-1+exp1
- 4.10.1-1+exp1
- 4.10.2-1
- 4.10.2-2
- 4.10.2-2+exp1
- 4.11.1-1
- 4.11.1-1+exp1
- 4.11.1-2
- 4.11.1-2+exp1
- 4.11.1-2.1
- 4.12.2-1
- 4.12.2-2
- 4.12.2-3
- 4.12.4-1
- 4.12.4-2
- 4.13.1-1
- 4.9.11-1
- 4.9.11-1+exp1
- 4.9.11-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- https://access.redhat.com/errata/RHSA-2025:9184
- https://access.redhat.com/errata/RHSA-2025:9185
- https://access.redhat.com/errata/RHSA-2025:9186
- https://access.redhat.com/errata/RHSA-2025:9187
- https://access.redhat.com/errata/RHSA-2025:9188
- https://access.redhat.com/errata/RHSA-2025:9189
- https://access.redhat.com/errata/RHSA-2025:9190
- https://access.redhat.com/errata/RHSA-2025:9191
- https://access.redhat.com/errata/RHSA-2025:9192
- https://access.redhat.com/errata/RHSA-2025:9193
- https://access.redhat.com/errata/RHSA-2025:9194
- https://access.redhat.com/security/cve/CVE-2025-4404
- https://bugzilla.redhat.com/show_bug.cgi?id=2364606
- https://pagure.io/freeipa/c/6b9400c135ed16b10057b350cc9ce42aa0e862d4
- https://pagure.io/freeipa/c/796ed20092d554ee0c9e23295e346ec1e8a0bf6e
- http://www.openwall.com/lists/oss-security/2025/09/30/6
- https://nvd.nist.gov/vuln/detail/CVE-2025-4404