Cloudanix VulnDB

CVE-2024-11029

Medium · 5.5

CVSS

5.5

EPSS

0.2%

Published

Jan 15, 2025

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

During setup of the identity management software an administrative password was accidentally saved in system logs where other users or central logging systems could read it.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Data Exposure
Component
Application
Class
Credential Exposure
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The FreeIPA API audit mechanism passes the entire command line, including the administrator password supplied during installation, to journalctl where it is stored in the journal database.

Why it matters to the business

Organizations using centralized logging can have administrative directory credentials exposed to log readers, enabling unauthorized access to identity management systems and potential domain compromise.

How an attack unfolds

An attacker with read access to journal logs on a system where FreeIPA was installed searches the journal for the installation command line and extracts the clear-text administrator password that was inadvertently logged.

How to fix it

Upgrade affected FreeIPA packages to versions that no longer emit full command lines containing credentials to the journal; for the listed Tomcat6 packages on Red Hat Enterprise Linux 6 the fixed release is 0:6.0.24-78.el6_5 across all variants.

How to confirm the fix worked

Review journal entries on systems where FreeIPA installation occurred and confirm absence of command lines containing password arguments; verify package versions match or exceed the fixed releases provided for each affected Tomcat6 component.

Typical attack path

  1. Obtain access to centralized or local journal logs
  2. Search journal entries for FreeIPA installation commands containing the 'ipa-server-install' or similar invocations
  3. Extract the --admin-password or equivalent credential value from the logged command line
  4. Use recovered credentials to authenticate to FreeIPA as administrator

How to detect it

Search systemd journal files and any forwarded log stores for FreeIPA installation command lines containing password arguments; look for processes invoking ipa-server-install or ipa-replica-install with credential flags.

  • ipa-server-install.*--admin-password
  • ipa-replica-install.*--admin-password
  • journalctl.*freeipa.*install

What your security team should do

  • Immediately audit journal logs on all systems that have run FreeIPA installation to determine exposure
  • Rotate any administrator passwords that appear in historical journal entries
  • Apply the listed fixed package versions (0:6.0.24-78.el6_5) to all affected Tomcat6 and FreeIPA installations
  • Disable or filter command-line logging for privileged installation tools until patches are deployed

The record

A flaw was found in the FreeIPA API audit, where it sends the whole FreeIPA command line to journalctl. As a consequence, during the FreeIPA installation process, it inadvertently leaks the administrative user credentials, including the administrator password, to the journal database. In the worst-case scenario, where the journal log is centralized, users with access to it can have improper access to the FreeIPA administrator credentials.

Affected packages

Ecosystem Package Introduced Fixed
AlmaLinux:9 ipa-client 0 4.12.2-1.el9_5.3
AlmaLinux:9 ipa-client-common 0 4.12.2-1.el9_5.3
AlmaLinux:9 ipa-client-epn 0 4.12.2-1.el9_5.3
AlmaLinux:9 ipa-client-samba 0 4.12.2-1.el9_5.3
AlmaLinux:9 ipa-common 0 4.12.2-1.el9_5.3
AlmaLinux:9 ipa-selinux 0 4.12.2-1.el9_5.3
AlmaLinux:9 ipa-selinux-luna 0 4.12.2-1.el9_5.3
AlmaLinux:9 ipa-selinux-nfast 0 4.12.2-1.el9_5.3
AlmaLinux:9 ipa-server 0 4.12.2-1.el9_5.3
AlmaLinux:9 ipa-server-common 0 4.12.2-1.el9_5.3
AlmaLinux:9 ipa-server-dns 0 4.12.2-1.el9_5.3
AlmaLinux:9 ipa-server-trust-ad 0 4.12.2-1.el9_5.3
AlmaLinux:9 python3-ipaclient 0 4.12.2-1.el9_5.3
AlmaLinux:9 python3-ipalib 0 4.12.2-1.el9_5.3
AlmaLinux:9 python3-ipaserver 0 4.12.2-1.el9_5.3
AlmaLinux:9 python3-ipatests 0 4.12.2-1.el9_5.3
Debian:12 freeipa 0 No fix
Debian:13 freeipa 0 No fix
Red Hat:enterprise_linux:9::appstream ipa 0 0:4.12.2-1.el9_5.3
Red Hat:enterprise_linux:9::appstream ipa-client 0 0:4.12.2-1.el9_5.3
Red Hat:enterprise_linux:9::appstream ipa-client-common 0 0:4.12.2-1.el9_5.3
Red Hat:enterprise_linux:9::appstream ipa-client-debuginfo 0 0:4.12.2-1.el9_5.3
Red Hat:enterprise_linux:9::appstream ipa-client-epn 0 0:4.12.2-1.el9_5.3
Red Hat:enterprise_linux:9::appstream ipa-client-samba 0 0:4.12.2-1.el9_5.3
Red Hat:enterprise_linux:9::appstream ipa-common 0 0:4.12.2-1.el9_5.3
Red Hat:enterprise_linux:9::appstream ipa-debuginfo 0 0:4.12.2-1.el9_5.3
Red Hat:enterprise_linux:9::appstream ipa-debugsource 0 0:4.12.2-1.el9_5.3
Red Hat:enterprise_linux:9::appstream ipa-selinux 0 0:4.12.2-1.el9_5.3
Red Hat:enterprise_linux:9::appstream ipa-selinux-luna 0 0:4.12.2-1.el9_5.3
Red Hat:enterprise_linux:9::appstream ipa-selinux-nfast 0 0:4.12.2-1.el9_5.3
Red Hat:enterprise_linux:9::appstream ipa-server 0 0:4.12.2-1.el9_5.3
Red Hat:enterprise_linux:9::appstream ipa-server-common 0 0:4.12.2-1.el9_5.3
Red Hat:enterprise_linux:9::appstream ipa-server-debuginfo 0 0:4.12.2-1.el9_5.3
Red Hat:enterprise_linux:9::appstream ipa-server-dns 0 0:4.12.2-1.el9_5.3
Red Hat:enterprise_linux:9::appstream ipa-server-trust-ad 0 0:4.12.2-1.el9_5.3
Red Hat:enterprise_linux:9::appstream ipa-server-trust-ad-debuginfo 0 0:4.12.2-1.el9_5.3
Red Hat:enterprise_linux:9::appstream python3-ipaclient 0 0:4.12.2-1.el9_5.3
Red Hat:enterprise_linux:9::appstream python3-ipalib 0 0:4.12.2-1.el9_5.3
Red Hat:enterprise_linux:9::appstream python3-ipaserver 0 0:4.12.2-1.el9_5.3
Red Hat:enterprise_linux:9::appstream python3-ipatests 0 0:4.12.2-1.el9_5.3
Red Hat:enterprise_linux:9::crb ipa 0 0:4.12.2-1.el9_5.3
Red Hat:enterprise_linux:9::crb ipa-client 0 0:4.12.2-1.el9_5.3
Red Hat:enterprise_linux:9::crb ipa-client-common 0 0:4.12.2-1.el9_5.3
Red Hat:enterprise_linux:9::crb ipa-client-debuginfo 0 0:4.12.2-1.el9_5.3
Red Hat:enterprise_linux:9::crb ipa-client-epn 0 0:4.12.2-1.el9_5.3
Red Hat:enterprise_linux:9::crb ipa-client-samba 0 0:4.12.2-1.el9_5.3
Red Hat:enterprise_linux:9::crb ipa-common 0 0:4.12.2-1.el9_5.3
Red Hat:enterprise_linux:9::crb ipa-debuginfo 0 0:4.12.2-1.el9_5.3
Red Hat:enterprise_linux:9::crb ipa-debugsource 0 0:4.12.2-1.el9_5.3
Red Hat:enterprise_linux:9::crb ipa-selinux 0 0:4.12.2-1.el9_5.3
Red Hat:enterprise_linux:9::crb ipa-selinux-luna 0 0:4.12.2-1.el9_5.3
Red Hat:enterprise_linux:9::crb ipa-selinux-nfast 0 0:4.12.2-1.el9_5.3
Red Hat:enterprise_linux:9::crb ipa-server 0 0:4.12.2-1.el9_5.3
Red Hat:enterprise_linux:9::crb ipa-server-common 0 0:4.12.2-1.el9_5.3
Red Hat:enterprise_linux:9::crb ipa-server-debuginfo 0 0:4.12.2-1.el9_5.3
Red Hat:enterprise_linux:9::crb ipa-server-dns 0 0:4.12.2-1.el9_5.3
Red Hat:enterprise_linux:9::crb ipa-server-trust-ad 0 0:4.12.2-1.el9_5.3
Red Hat:enterprise_linux:9::crb ipa-server-trust-ad-debuginfo 0 0:4.12.2-1.el9_5.3
Red Hat:enterprise_linux:9::crb python3-ipaclient 0 0:4.12.2-1.el9_5.3
Red Hat:enterprise_linux:9::crb python3-ipalib 0 0:4.12.2-1.el9_5.3
Red Hat:enterprise_linux:9::crb python3-ipaserver 0 0:4.12.2-1.el9_5.3
Red Hat:enterprise_linux:9::crb python3-ipatests 0 0:4.12.2-1.el9_5.3
Ubuntu:18.04:LTS freeipa 0 No fix
Ubuntu:20.04:LTS freeipa 0 No fix
Ubuntu:22.04:LTS freeipa 0 No fix
Ubuntu:24.04:LTS freeipa 0 No fix
Ubuntu:24.10 freeipa 0 No fix
Ubuntu:25.04 freeipa 0 No fix
Ubuntu:25.10 freeipa 0 No fix
Ubuntu:Pro:14.04:LTS freeipa 0 No fix
Ubuntu:Pro:16.04:LTS freeipa 0 No fix
Ubuntu:Pro:18.04:LTS freeipa 0 No fix
Ubuntu:Pro:20.04:LTS freeipa 0 No fix

Related vulnerabilities