Maple Labs

CVE search · CVE-2019-14867

CVE-2019-14867

high 8.8

A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way the internal function ber_scanf() was used in some components of the IPA server, which parsed kerberos key data. An unauthenticated attacker who could trigger parsing of the krb principal key could cause the IPA server to crash or in some conditions, cause arbitrary code to be executed on the server hosting the IPA server.

Open in the NVD CVE.org JSON

Details

Status
Modified
Published
Last changed
Source
secalert@redhat.com
Weakness
CWE-94, CWE-400

Severity

VersionScoreVectorSource
CVSS 3.1 high 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H nvd@nist.govPrimary
CVSS 3.0 high 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H secalert@redhat.comSecondary
CVSS 2.0 medium 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P nvd@nist.govPrimary

Affected products

Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.

References