CVE-2012-5484PYSEC-2013-36PYSEC-2013-38
The client in FreeIPA 2.x and 3.x before 3.1.2 does not properly obtain the Certification Authority (CA) certificate from the server, which
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The client in FreeIPA 2.x and 3.x before 3.1.2 does not properly obtain the Certification Authority (CA) certificate from the server, which allows man-in-the-middle attackers to spoof a join procedure via a crafted certificate.
Timeline
- CVE published
- Record last updated
Affected versions
- n/a n/a
Version range not reported
References 9
git.fedorahosted.org
- cgit/freeipa.git/commit?id=31e41eea6c2322689826e6065ceba82551c565aa
- cgit/freeipa.git/commit?id=a1991aeac19c3fec1fdd0d184c6760c90c9f9fc9
- cgit/freeipa.git/commit?id=18eea90ebb24a9c22248f0b7e18646cc6e3e3e0f
- cgit/freeipa.git/commit?id=91f4af7e6af53e1c6bf17ed36cb2161863eddae4
- cgit/freeipa.git/commit?id=a40285c5a0288669b72f9d991508d4405885bffc