Skip to content
Fencer Vulns
medium 6.5

CVE-2023-5455 json

Ipa: invalid csrf protection

published 2024-01-10 2 y ago modified 2026-11-05 4 d ago also EUVD-2023-57769

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 47%
public exploits
0
none known

Summary

A Cross-site request forgery vulnerability exists in ipa/session/login_password in all supported versions of IPA. This flaw allows an attacker to trick the user into submitting a request that could perform actions as the user, resulting in a loss of confidentiality and system integrity. During community penetration testing it was found that for certain HTTP end-points FreeIPA does not ensure CSRF protection. Due to implementation details one cannot use this flaw for reflection of a cookie representing already logged-in user. An attacker would always have to go through a new authentication attempt.

Patch / fix

  • Red Hat Red Hat Enterprise Linux 7 0:4.6.8-5.el7_9.16
  • Red Hat Red Hat Enterprise Linux 8 8090020231201152514.3387e3d0
  • Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support 8020020231123154806.792f4060
  • Red Hat Red Hat Enterprise Linux 8.2 Telecommunications Update Service 8020020231123154806.792f4060
  • Red Hat Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions 8020020231123154806.792f4060
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 8040020231123154610.5b01ab7e
  • Red Hat Red Hat Enterprise Linux 8.4 Telecommunications Update Service 8040020231123154610.5b01ab7e
  • Red Hat Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions 8040020231123154610.5b01ab7e
  • Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support 8060020231208020207.ada582f1
  • Red Hat Red Hat Enterprise Linux 8.8 Extended Update Support 8080020231201153604.b0a6ceea
  • Red Hat Red Hat Enterprise Linux 9 0:4.10.2-5.el9_3
  • Red Hat Red Hat Enterprise Linux 9.0 Extended Update Support 0:4.9.8-9.el9_0
  • Red Hat Red Hat Enterprise Linux 9.2 Extended Update Support 0:4.10.1-10.el9_2
  • freeipa Debian 14, Debian 13 4.11.1-1

debian advisories DEBIAN-CVE-2023-5455

  • ipa RHEL 9 4.10.2-5.el9_3
  • ipa-client RHEL 9 4.10.2-5.el9_3
  • ipa-common RHEL 9 4.10.2-5.el9_3
  • ipa-server RHEL 9 4.10.2-5.el9_3
  • ipa-selinux RHEL 9 4.10.2-5.el9_3
  • ipa-client-epn RHEL 9 4.10.2-5.el9_3
  • ipa-server-dns RHEL 9 4.10.2-5.el9_3
  • python3-ipalib RHEL 9 4.10.2-5.el9_3

red hat advisories RHSA-2024:0137RHSA-2024:0141RHSA-2024:0145RHSA-2024:0138RHSA-2024:0139RHSA-2024:0143

  • ipa-client AlmaLinux 9 4.10.2-5.el9_3.alma.1
  • ipa-common AlmaLinux 9 4.10.2-5.el9_3.alma.1
  • ipa-server AlmaLinux 9 4.10.2-5.el9_3.alma.1
  • ipa-selinux AlmaLinux 9 4.10.2-5.el9_3.alma.1
  • ipa-client-epn AlmaLinux 9 4.10.2-5.el9_3.alma.1
  • ipa-server-dns AlmaLinux 9 4.10.2-5.el9_3.alma.1
  • python3-ipalib AlmaLinux 9 4.10.2-5.el9_3.alma.1
  • ipa-client-samba AlmaLinux 9 4.10.2-5.el9_3.alma.1

almalinux advisories ALSA-2024:0141ALSA-2024:0143

  • pyusb Rocky Linux 8 1.0.0-9.1.module+el8.9.0+1371+ffa84eb9
  • pyusb Rocky Linux 8 1.0.0-9.1.module+el8.9.0+1372+09f67869
  • softhsm Rocky Linux 8 2.6.0-5.module+el8.9.0+1371+ffa84eb9
  • custodia Rocky Linux 8 0.6.0-3.module+el8.9.0+1371+ffa84eb9
  • slapi-nis Rocky Linux 8 0.60.0-4.module+el8.9.0+1573+39ab85f4
  • opendnssec Rocky Linux 8 2.1.7-1.module+el8.9.0+1371+ffa84eb9
  • python-qrcode Rocky Linux 8 5.1-12.module+el8.9.0+1371+ffa84eb9
  • python-qrcode Rocky Linux 8 5.1-12.module+el8.9.0+1372+09f67869

rocky linux advisories RLSA-2024:0143

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-5455 updated cvss 6.5

ipa: Invalid CSRF protection

  • Red Hat Enterprise Linux 6 ipa, ipa-client, ipa-python, ipa-server, ipa-admintools, ipa-server-selinux, +1 more
    affected: workaround, no fix planned “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.”
  • Red Hat CodeReady Linux Builder (v. 9) python3-ipatests 4.10.2-5.el9_3
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2024:0141
  • Red Hat CodeReady Linux Builder EUS (v.9.0) python3-ipatests 4.9.8-9.el9_0
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2024:0140
  • Red Hat CodeReady Linux Builder EUS (v.9.2) python3-ipatests 4.10.1-10.el9_2
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2024:0142
  • Red Hat Enterprise Linux AppStream (v. 8) ipa 4.9.12-11.module+el8.9.0+20824+f2605038, pyusb 1.0.0-9.1.module+el8.9.0+18911+94941f82, softhsm 2.6.0-5.module+el8.9.0+18911+94941f82, custodia 0.6.0-3.module+el8.9.0+18911+94941f82, opendnssec 2.1.7-1.module+el8.9.0+18911+94941f82, slapi-nis 0.60.0-4.module+el8.9.0+20420+fef9eb45, +29 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2024:0143
  • Red Hat Enterprise Linux AppStream (v. 9) ipa 4.10.2-5.el9_3, ipa-client 4.10.2-5.el9_3, ipa-common 4.10.2-5.el9_3, ipa-server 4.10.2-5.el9_3, ipa-selinux 4.10.2-5.el9_3, ipa-client-epn 4.10.2-5.el9_3, +8 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2024:0141
  • Red Hat Enterprise Linux AppStream AUS (v. 8.2) ipa 4.8.4-14.module+el8.2.0+20745+1d1ce1ed, pyusb 1.0.0-9.module+el8.1.0+4098+f286395e, softhsm 2.4.0-4.module+el8.2.0+5779+a38c524f, custodia 0.6.0-3.module+el8.1.0+4098+f286395e, opendnssec 1.4.14-1.module+el8.1.0+4098+f286395e, slapi-nis 0.56.3-3.module+el8.2.0+10782+8facb0b2, +28 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2024:0144
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) ipa 4.9.2-10.module+el8.4.0+20744+ffd02a6d, pyusb 1.0.0-9.module+el8.1.0+4098+f286395e, custodia 0.6.0-3.module+el8.1.0+4098+f286395e, softhsm 2.6.0-5.module+el8.4.0+10227+076cd560, opendnssec 2.1.7-1.module+el8.4.0+9007+5084bdd8, ipa-client 4.9.2-10.module+el8.4.0+20744+ffd02a6d, +29 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2024:0138
show 10 more
  • Red Hat Enterprise Linux AppStream E4S (v. 8.2) ipa 4.8.4-14.module+el8.2.0+20745+1d1ce1ed, pyusb 1.0.0-9.module+el8.1.0+4098+f286395e, softhsm 2.4.0-4.module+el8.2.0+5779+a38c524f, custodia 0.6.0-3.module+el8.1.0+4098+f286395e, opendnssec 1.4.14-1.module+el8.1.0+4098+f286395e, slapi-nis 0.56.3-3.module+el8.2.0+10782+8facb0b2, +28 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2024:0144
  • Red Hat Enterprise Linux AppStream E4S (v.8.4) ipa 4.9.2-10.module+el8.4.0+20744+ffd02a6d, pyusb 1.0.0-9.module+el8.1.0+4098+f286395e, custodia 0.6.0-3.module+el8.1.0+4098+f286395e, softhsm 2.6.0-5.module+el8.4.0+10227+076cd560, opendnssec 2.1.7-1.module+el8.4.0+9007+5084bdd8, ipa-client 4.9.2-10.module+el8.4.0+20744+ffd02a6d, +29 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2024:0138
  • Red Hat Enterprise Linux AppStream EUS (v.8.6) ipa 4.9.8-11.module+el8.6.0+20984+095e5c46, pyusb 1.0.0-9.module+el8.1.0+4098+f286395e, custodia 0.6.0-3.module+el8.1.0+4098+f286395e, softhsm 2.6.0-5.module+el8.4.0+10227+076cd560, opendnssec 2.1.7-1.module+el8.4.0+9007+5084bdd8, slapi-nis 0.60.0-1.module+el8.6.0+16878+6c033536, +29 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2024:0139
  • Red Hat Enterprise Linux AppStream EUS (v.8.8) ipa 4.9.11-9.module+el8.8.0+20825+52dd1628, custodia 0.6.0-3.module+el8.1.0+4098+f286395e, pyusb 1.0.0-9.1.module+el8.7.0+15691+2b2c1dd5, softhsm 2.6.0-5.module+el8.4.0+10227+076cd560, opendnssec 2.1.7-1.module+el8.4.0+9007+5084bdd8, slapi-nis 0.60.0-4.module+el8.8.0+20635+330e3683, +29 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2024:0137
  • Red Hat Enterprise Linux AppStream EUS (v.9.0) ipa 4.9.8-9.el9_0, ipa-client 4.9.8-9.el9_0, ipa-common 4.9.8-9.el9_0, ipa-server 4.9.8-9.el9_0, ipa-selinux 4.9.8-9.el9_0, ipa-client-epn 4.9.8-9.el9_0, +8 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2024:0140
  • Red Hat Enterprise Linux AppStream EUS (v.9.2) ipa 4.10.1-10.el9_2, ipa-client 4.10.1-10.el9_2, ipa-common 4.10.1-10.el9_2, ipa-server 4.10.1-10.el9_2, ipa-selinux 4.10.1-10.el9_2, ipa-client-epn 4.10.1-10.el9_2, +8 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2024:0142
  • Red Hat Enterprise Linux AppStream TUS (v. 8.2) ipa 4.8.4-14.module+el8.2.0+20745+1d1ce1ed, pyusb 1.0.0-9.module+el8.1.0+4098+f286395e, softhsm 2.4.0-4.module+el8.2.0+5779+a38c524f, custodia 0.6.0-3.module+el8.1.0+4098+f286395e, opendnssec 1.4.14-1.module+el8.1.0+4098+f286395e, slapi-nis 0.56.3-3.module+el8.2.0+10782+8facb0b2, +28 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2024:0144
  • Red Hat Enterprise Linux AppStream TUS (v.8.4) ipa 4.9.2-10.module+el8.4.0+20744+ffd02a6d, pyusb 1.0.0-9.module+el8.1.0+4098+f286395e, custodia 0.6.0-3.module+el8.1.0+4098+f286395e, softhsm 2.6.0-5.module+el8.4.0+10227+076cd560, opendnssec 2.1.7-1.module+el8.4.0+9007+5084bdd8, ipa-client 4.9.2-10.module+el8.4.0+20744+ffd02a6d, +29 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2024:0138
  • Red Hat Enterprise Linux Client (v. 7) ipa 4.6.8-5.el7_9.16, ipa-client 4.6.8-5.el7_9.16, ipa-common 4.6.8-5.el7_9.16, python2-ipalib 4.6.8-5.el7_9.16, ipa-client-common 4.6.8-5.el7_9.16, ipa-python-compat 4.6.8-5.el7_9.16, +1 more Red Hat Enterprise Linux Client Optional (v. 7) ipa-server 4.6.8-5.el7_9.16, ipa-server-dns 4.6.8-5.el7_9.16, ipa-server-common 4.6.8-5.el7_9.16, python2-ipaserver 4.6.8-5.el7_9.16, ipa-server-trust-ad 4.6.8-5.el7_9.16 Red Hat Enterprise Linux ComputeNode Optional (v. 7) ipa-server 4.6.8-5.el7_9.16, ipa-server-dns 4.6.8-5.el7_9.16, ipa-server-common 4.6.8-5.el7_9.16, python2-ipaserver 4.6.8-5.el7_9.16, ipa-server-trust-ad 4.6.8-5.el7_9.16 Red Hat Enterprise Linux Server (v. 7) ipa 4.6.8-5.el7_9.16, ipa-client 4.6.8-5.el7_9.16, ipa-common 4.6.8-5.el7_9.16, ipa-server 4.6.8-5.el7_9.16, ipa-server-dns 4.6.8-5.el7_9.16, python2-ipalib 4.6.8-5.el7_9.16, +6 more Red Hat Enterprise Linux Workstation (v. 7) ipa 4.6.8-5.el7_9.16, ipa-client 4.6.8-5.el7_9.16, ipa-common 4.6.8-5.el7_9.16, ipa-server 4.6.8-5.el7_9.16, ipa-server-dns 4.6.8-5.el7_9.16, python2-ipalib 4.6.8-5.el7_9.16, +6 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2024:0145
  • Red Hat Enterprise Linux 8 ipa, krb5, libkadm5, krb5-libs, ipa-client, ipa-common, +17 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

0.57% chance of exploitation in the next 30 days, higher than 47% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
NVD 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Affected products

  • Red Hat Red Hat Enterprise Linux 7
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support
  • Red Hat Red Hat Enterprise Linux 8.2 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.4 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 8.8 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.0 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 9.2 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 6

Classification

Weakness
  • CWE-352 Cross-Site Request Forgery

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.