CVE-2019-14867: fedoraproject fedora Code Injection
Vulnerability summary
CVE-2019-14867 is a high (CVSS 8.8) Code Injection vulnerability in fedoraproject fedora. EPSS estimates a 7.41% chance of exploitation in the next 30 days, higher than 94.3% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 3Timeline
- 27-11-2019PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way the internal function ber_scanf() was used in some components of the IPA server, which parsed kerberos key data. An unauthenticated attacker who could trigger parsing of the krb principal key could cause the IPA server to crash or in some conditions, cause arbitrary code to be executed on the server hosting the IPA server.
CVSS metrics
9 scores · 5 sources · 4 versions- OSV · PypiEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- NVDNIST8.8HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
7.41%
Chance of exploitation in the next 30 days
Percentile
94%
Versus all other CVEs
30-day change
0.00 pp
From 7.41% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
Affected systems
PyPI2 products
- freeipa≥ 4.6.2, < 4.6.7 | ≥ 4.7.0, < 4.7.4 | ≥ 4.8.0, < 4.8.3
- ipa≥ 4.6.2, < 4.6.7 | ≥ 4.7.0, < 4.7.4 | ≥ 4.8.0, < 4.8.3
Debian1 product
- freeipa< 4.8.3-1
Fedoraproject1 product
- fedoraEOL30 | 31
Freeipa1 product
- freeipa≥ 4.6.0, < 4.6.7 | ≥ 4.7.0, < 4.7.4 | ≥ 4.8.0, < 4.8.3
Red hat1 product
- ipaall IPA 4.6.x versions before 4.6.7 | all IPA 4.7.x versions before 4.7.4 | all IPa 4.8.x versions before 4.8.3
Ubuntu1 product
- freeipaAll versions (No fix recorded)
6 vendors · 7 products
References
21 links- bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14867X Refsource CONFIRMIssue TrackingThird Party AdvisoryWEBREPORT
Show all 21 references
- pypi.org/project/freeipaPACKAGE
