CVE-2017-2590: freeipa
Vulnerability summary
CVE-2017-2590 is a high (CVSS 8.1) vulnerability in freeipa. EPSS estimates a 1.27% chance of exploitation in the next 30 days, higher than 69.3% of scored vulnerabilities.
Timeline
- 27-07-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
A vulnerability was found in ipa before 4.4. IdM's ca-del, ca-disable, and ca-enable commands did not properly check the user's permissions while modifying CAs in Dogtag. An authenticated, unauthorized attacker could use this flaw to delete, disable, or enable CAs causing various denial of service problems with certificate issuance, OCSP signing, and deletion of secret keys.
CVSS metrics
5 scores · 4 sources · 2 versions- NVDNIST8.1HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
- OSV · Red hatEcosystem advisory · calculated8.1HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated8.1HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
EPSS trend
Probability
1.27%
Chance of exploitation in the next 30 days
Percentile
69%
Versus all other CVEs
30-day change
-0.02 pp
From 1.28% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-732Incorrect Permission Assignment for Critical ResourceThe product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
- CWE-275Permission IssuesWeaknesses in this category are related to improper assignment or handling of permissions.
Affected systems
Redhat20 products
- enterprise_linuxEOL7.0
- enterprise_linux_desktop7.0
- enterprise_linux_server7.0
- enterprise_linux_server_aus7.3 | 7.4
- enterprise_linux_server_eus7.3 | 7.4 | 7.5
Freeipa1 product
- freeipa< 4.4.0
Red hat1 product
- ipa4.4
Ubuntu1 product
- freeipa< 4.7.0~pre1+git20180411-2ubuntu2
4 vendors · 23 products
