EUVD-2025-18495Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: redhat
Lifecycle Timeline
4DescriptionCVE.org
A privilege escalation from host to domain vulnerability was found in the FreeIPA project. The FreeIPA package fails to validate the uniqueness of the krbCanonicalName for the admin account by default, allowing users to create services with the same canonical name as the REALM admin. When a successful attack happens, the user can retrieve a Kerberos ticket in the name of this service, containing the admin@REALM credential. This flaw allows an attacker to perform administrative tasks over the REALM, leading to access to sensitive data and sensitive data exfiltration.
AnalysisAI
Critical privilege escalation vulnerability in FreeIPA that allows authenticated users with high privileges to create Kerberos services with the same canonical name (krbCanonicalName) as the realm administrator, enabling them to obtain administrative credentials. The vulnerability affects FreeIPA default configurations where uniqueness validation is not enforced, allowing attackers to retrieve Kerberos tickets with admin@REALM credentials and perform unrestricted administrative operations. With a CVSS 9.1 score and network-accessible attack vector, this represents a severe threat to FreeIPA-based identity infrastructures, particularly in environments where service creation permissions are delegated or insufficiently restricted.
Technical ContextAI
FreeIPA is an open-source identity management system built on LDAP, Kerberos, and DNS. The vulnerability stems from inadequate validation of the krbCanonicalName attribute, a critical identifier in Kerberos that uniquely identifies principals in the Key Distribution Center (KDC). CWE-1220 (Insufficient Granularity of Access Control) indicates the root cause: FreeIPA fails to enforce uniqueness constraints at the schema or application level, allowing duplicate canonical names across different service principals. The Kerberos protocol relies on canonical name uniqueness to ensure proper ticket issuance and validation; when an attacker creates a service with the admin's canonical name, the KDC may issue tickets bearing admin credentials to the attacker-controlled service. This is compounded by FreeIPA's default configuration not validating this constraint, making the issue present in standard deployments. The attack leverages the interaction between LDAP object creation (insufficient access control) and Kerberos ticket generation (canonical name collision).
RemediationAI
Immediate remediation steps: (1) Apply patches from FreeIPA upstream project addressing krbCanonicalName validation—patch versions should be released to enforce uniqueness constraints at the schema and application layer. (2) Contact Red Hat for RHEL Identity Management advisory patches (RHSA-* advisories). (3) Until patched, implement compensating controls: enforce LDAP schema constraints on krbCanonicalName uniqueness at the directory server level; restrict service creation permissions to trusted administrators only; audit existing services for duplicate canonical names and remove unauthorized entries. (4) Monitor FreeIPA upstream (freeipa.org) and Red Hat (access.redhat.com) for official patches. (5) Implement network segmentation restricting service creation requests to authorized administrative networks. (6) Enable Kerberos audit logging to detect unauthorized ticket requests for admin principals.
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and
Local privilege escalation in the GNU C Library (glibc) dynamic loader ld.so allows unprivileged local users on affected
Same technique Privilege Escalation
View allVendor StatusVendor
Ubuntu
Priority: Medium| Release | Status | Version |
|---|---|---|
| trusty | needs-triage | - |
| xenial | needs-triage | - |
| bionic | needs-triage | - |
| focal | needs-triage | - |
| jammy | needs-triage | - |
| noble | needs-triage | - |
| upstream | needs-triage | - |
| plucky | ignored | end of life, was needs-triage |
| oracular | ignored | end of life, was needs-triage |
| questing | needs-triage | - |
Debian
Bug #1108050| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bookworm | vulnerable | 4.9.11-1 | - |
| trixie | fixed | 4.12.4-1 | - |
| forky, sid | fixed | 4.13.1-1 | - |
| (unstable) | fixed | 4.12.4-1 | unimportant |
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Liberty Linux 8 | Fixed |
| SUSE Liberty Linux 9 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today