freeipa

Clone
Source Code
GIT

#6561 CVE-2016-7030 freeipa: ipa: DoS attack against kerberized services by abusing password policy
Closed: Fixed None Opened 7 years ago by mbasti.

Closed: Fixed
Reopen Issue

Ticket was cloned from Red Hat Bugzilla (product Fedora): Bug 1404690

This is an automatically created tracking bug!  It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.

For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.

For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs

When submitting as an update, use the fedpkg template provided in the next
comment(s).  This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.

Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.

NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time.  If you need to fix the versions independent of each other,
you may clone this bug as appropriate.

[bug automatically created by: add-tracking-bugs]

master:

  • 6f1d927 password policy: Add explicit default password policy for hosts and services
  • b1a2059 tests: Expect krbpwdpolicyreference in result of {host,service}-{find,show} --all

ipa-4-4:

  • 08e7af9 password policy: Add explicit default password policy for hosts and services
  • 171bc3e tests: Expect krbpwdpolicyreference in result of {host,service}-{find,show} --all

ipa-4-3:

  • 42263a5 password policy: Add explicit default password policy for hosts and services

This patch breaks upgrade

Linked to Bugzilla bug: https://bugzilla.redhat.com/show_bug.cgi?id=1404910 (Red Hat Enterprise Linux 7)

Fix for upgrade pushed to

ipa-4-3:

  • b9b919e ipa-kdb: search for password policies globally

ipa-4-4:

  • 84f6df6 ipa-kdb: search for password policies globally

master:

  • 73f3356 ipa-kdb: search for password policies globally

More commits with tests coming soon

test cases for kadmin pushed to:

master:

  • f596735 Make kadmin family of functions return the result of ipautil.run
  • d95bdbb Add a basic test suite for kadmin.local interface

ipa-4-4:

  • f0f48ec Make kadmin family of functions return the result of ipautil.run
  • e02323c Add a basic test suite for kadmin.local interface

test cases for kadmin pushed to:

master:

  • f596735 Make kadmin family of functions return the result of ipautil.run
  • d95bdbb Add a basic test suite for kadmin.local interface

ipa-4-4:

  • f0f48ec Make kadmin family of functions return the result of ipautil.run
  • e02323c Add a basic test suite for kadmin.local interface

Metadata Update from @mbasti:
- Issue assigned to dkupka
- Issue set to the milestone: FreeIPA 4.3.3
7 years ago

Login to comment on this ticket.

Metadata
None
None
None
critical
None
None
None
None
defect
None
None
IPA
None
https://github.com/freeipa/freeipa/pull/338
None
None
pvomacka
None
https://bugzilla.redhat.com/show_bug.cgi?id=1404690, https://bugzilla.redhat.com/show_bug.cgi?id=1404910
None
None
None
Powered by Pagure 5.13.3
Documentation • File an Issue • About • SSH Hostkey/Fingerprint
© Red Hat, Inc. and others.