RHSA-2024:0137MediumCVSS 7.2

Red Hat Security Advisory: idm:DL1 security update

Published
January 10, 2024
Last Modified
August 4, 2026

🔗 CVE IDs covered (2)

CVE-2020-17049 →CVE-2023-5455 →

📋 Description

CVE-2020-17049 — Kerberos: delegation constrain bypass in S4U2Proxy CVE-2023-5455 — ipa: Invalid CSRF protection

🎯 Affected products125

  • Red Hat Enterprise Linux AppStream EUS (v.8.8)
  • bind-dyndb-ldap-0:11.6-4.module+el8.8.0+17351+9a3fb056.aarch64 (idm:DL1) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)
  • bind-dyndb-ldap-0:11.6-4.module+el8.8.0+17351+9a3fb056.ppc64le (idm:DL1) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)
  • bind-dyndb-ldap-0:11.6-4.module+el8.8.0+17351+9a3fb056.s390x (idm:DL1) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)
  • bind-dyndb-ldap-0:11.6-4.module+el8.8.0+17351+9a3fb056.src (idm:DL1) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)
  • bind-dyndb-ldap-0:11.6-4.module+el8.8.0+17351+9a3fb056.x86_64 (idm:DL1) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)
  • bind-dyndb-ldap-debuginfo-0:11.6-4.module+el8.8.0+17351+9a3fb056.aarch64 (idm:DL1) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)
  • bind-dyndb-ldap-debuginfo-0:11.6-4.module+el8.8.0+17351+9a3fb056.ppc64le (idm:DL1) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)
  • bind-dyndb-ldap-debuginfo-0:11.6-4.module+el8.8.0+17351+9a3fb056.s390x (idm:DL1) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)
  • bind-dyndb-ldap-debuginfo-0:11.6-4.module+el8.8.0+17351+9a3fb056.x86_64 (idm:DL1) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)
  • bind-dyndb-ldap-debugsource-0:11.6-4.module+el8.8.0+17351+9a3fb056.aarch64 (idm:DL1) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)
  • bind-dyndb-ldap-debugsource-0:11.6-4.module+el8.8.0+17351+9a3fb056.ppc64le (idm:DL1) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)
  • bind-dyndb-ldap-debugsource-0:11.6-4.module+el8.8.0+17351+9a3fb056.s390x (idm:DL1) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)
  • bind-dyndb-ldap-debugsource-0:11.6-4.module+el8.8.0+17351+9a3fb056.x86_64 (idm:DL1) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)
  • custodia-0:0.6.0-3.module+el8.1.0+4098+f286395e.noarch (idm:DL1) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)
  • custodia-0:0.6.0-3.module+el8.1.0+4098+f286395e.src (idm:DL1) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)
  • ipa-0:4.9.11-9.module+el8.8.0+20825+52dd1628.src (idm:DL1) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)
  • ipa-client-0:4.9.11-9.module+el8.8.0+20825+52dd1628.aarch64 (idm:DL1) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)
  • ipa-client-0:4.9.11-9.module+el8.8.0+20825+52dd1628.ppc64le (idm:DL1) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)
  • ipa-client-0:4.9.11-9.module+el8.8.0+20825+52dd1628.s390x (idm:DL1) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)
  • ipa-client-0:4.9.11-9.module+el8.8.0+20825+52dd1628.x86_64 (idm:DL1) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)
  • ipa-client-common-0:4.9.11-9.module+el8.8.0+20825+52dd1628.noarch (idm:DL1) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)
  • ipa-client-debuginfo-0:4.9.11-9.module+el8.8.0+20825+52dd1628.aarch64 (idm:DL1) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)
  • ipa-client-debuginfo-0:4.9.11-9.module+el8.8.0+20825+52dd1628.ppc64le (idm:DL1) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)
  • ipa-client-debuginfo-0:4.9.11-9.module+el8.8.0+20825+52dd1628.s390x (idm:DL1) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)
  • ipa-client-debuginfo-0:4.9.11-9.module+el8.8.0+20825+52dd1628.x86_64 (idm:DL1) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)
  • ipa-client-epn-0:4.9.11-9.module+el8.8.0+20825+52dd1628.aarch64 (idm:DL1) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)
  • ipa-client-epn-0:4.9.11-9.module+el8.8.0+20825+52dd1628.ppc64le (idm:DL1) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)
  • ipa-client-epn-0:4.9.11-9.module+el8.8.0+20825+52dd1628.s390x (idm:DL1) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)
  • ipa-client-epn-0:4.9.11-9.module+el8.8.0+20825+52dd1628.x86_64 (idm:DL1) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)
  • +95 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: In Red Hat Identity Management (IdM), the list of existing rules for service principals delegation can be obtained with the following commands : $ ipa servicedelegationrule-find $ ipa servicedelegationtarget-find The services allowed to delegate must all be trusted. By default, only HTTP/<IPA host>@<REALM>, corresponding to IdM's Web UI, is allowed to delegate. Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.

🔗 References (5)