CVE-2019-14867CWE-400CWE-94
A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way the internal function…
High · published November 27, 2019
What it is
A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way the internal function ber_scanf() was used in some components of the IPA server, which parsed kerberos key data. An unauthenticated attacker who could trigger parsing of the krb principal key could cause the IPA server to crash or in some conditions, cause arbitrary code to be executed on the server hosting the IPA server.
The record
Technical detail
- CVSS v3.0
- 8.8 · HIGH
- Vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS v4.0
- Not supplied
- EPSS
- 0.07413 · 94.4th percentile
- Weaknesses
- CWE-400 · Uncontrolled Resource Consumption; CWE-94 · Improper Control of Generation of Code ('Code Injection')
- Published
- 2019-11-27T08:05Z
EPSS history
Timeline
27 NOV 08:05Z
A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way the internal function…
cvelistv5