Vulnerability CVE-2019-10195

Vulnerability Name:

CVE-2019-10195 (CCN-172430)

Assigned:

2019-11-26

Published:

2019-11-26

Updated:

2020-02-05

Summary:

A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way that FreeIPA's batch processing API logged operations. This included passing user passwords in clear text on FreeIPA masters. Batch processing of commands with passwords as arguments or options is not performed by default in FreeIPA but is possible by third-party components. An attacker having access to system logs on FreeIPA masters could use this flaw to produce log file content with passwords exposed.

CVSS v3 Severity:

6.5 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
5.7 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): Low User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): None Availibility (A): None

5.7 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N)
5.0 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): Low User Interaction (UI): Required
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): None Availibility (A): None

5.7 Medium (REDHAT CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N)
5.0 Medium (REDHAT Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): Low User Interaction (UI): Required
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): None Availibility (A): None

CVSS v2 Severity:

4.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:N/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): Partial Integrity (I): None Availibility (A): None

6.8 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:C/I:N/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): Complete Integrity (I): None Availibility (A): None

Vulnerability Type:

CWE-532
CWE-532
CWE-200
CWE-200

Vulnerability Consequences:

Obtain Information

References:

Source: MITRE
Type: CNA
CVE-2019-10195

Source: REDHAT
Type: UNKNOWN
RHBA-2019:4268

Source: REDHAT
Type: UNKNOWN
RHSA-2020:0378

Source: CCN
Type: Red Hat Bugzilla - Bug 1726223
CVE-2019-10195 IPA: batch API logging user passwords to /var/log/httpd/error_log

Source: CONFIRM
Type: Issue Tracking, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10195

Source: XF
Type: UNKNOWN
freeipa-cve201910195-info-disc(172430)

Source: FEDORA
Type: Mailing List, Third Party Advisory
FEDORA-2019-c64e1612f5

Source: FEDORA
Type: Mailing List, Third Party Advisory
FEDORA-2019-8e9093da55

Source: CCN
Type: FreeIPA Web site
FreeIPA

Source: MISC
Type: Release Notes
https://www.freeipa.org/page/Releases/4.6.7

Source: MISC
Type: Release Notes
https://www.freeipa.org/page/Releases/4.7.4

Source: MISC
Type: Release Notes
https://www.freeipa.org/page/Releases/4.8.3

Vulnerable Configuration:

Configuration 1:

cpe:/a:freeipa:freeipa:*:*:*:*:*:*:*:* (Version >= 4.6.0 and < 4.6.7)

OR cpe:/a:freeipa:freeipa:*:*:*:*:*:*:*:* (Version >= 4.7.0 and < 4.7.4)

OR cpe:/a:freeipa:freeipa:*:*:*:*:*:*:*:* (Version >= 4.8.0 and < 4.8.3)

Configuration 2:

cpe:/o:fedoraproject:fedora:30:*:*:*:*:*:*:*

OR cpe:/o:fedoraproject:fedora:31:*:*:*:*:*:*:*

Configuration RedHat 1:

cpe:/a:redhat:enterprise_linux:8:*:*:*:*:*:*:*

Configuration RedHat 2:

cpe:/a:redhat:enterprise_linux:8::appstream:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:com.redhat.rhsa:def:20200378	P	RHSA-2020:0378: ipa security and bug fix update (Important)	2020-02-04
oval:com.redhat.rhba:def:20194268	P	RHBA-2019:4268: idm:DL1 bug fix update (Important)	2019-12-17
oval:com.ubuntu.disco:def:2019101950000000	V	CVE-2019-10195 on Ubuntu 19.04 (disco) - medium.	2019-11-27
oval:com.ubuntu.bionic:def:2019101950000000	V	CVE-2019-10195 on Ubuntu 18.04 LTS (bionic) - medium.	2019-11-27
oval:com.ubuntu.xenial:def:2019101950000000	V	CVE-2019-10195 on Ubuntu 16.04 LTS (xenial) - medium.	2019-11-27

BACK