CVE-2024-2698

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-2698
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-2698.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-2698
Downstream
Related
Published
2024-06-12T08:03:49Z
Modified
2026-08-12T03:51:37Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Freeipa: delegation rules allow a proxy service to impersonate any user to access another target service
Details

A vulnerability was found in FreeIPA in how the initial implementation of MS-SFU by MIT Kerberos was missing a condition for granting the "forwardable" flag on S4U2Self tickets. Fixing this mistake required adding a special case for the check_allowed_to_delegate() function: If the target service argument is NULL, then it means the KDC is probing for general constrained delegation rules and not checking a specific S4U2Proxy request.

In FreeIPA 4.11.0, the behavior of ipadb_match_acl() was modified to match the changes from upstream MIT Kerberos 1.20. However, a mistake resulting in this mechanism applies in cases where the target service argument is set AND where it is unset. This results in S4U2Proxy requests being accepted regardless of whether or not there is a matching service delegation rule.

Database specific 
{
    "cna_assigner": "redhat",
    "cwe_ids": [
        "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/2xxx/CVE-2024-2698.json"
}
References

Affected packages

Git / github.com/freeipa/freeipa

Affected ranges

Type
GIT
Repo
https://github.com/freeipa/freeipa
Events
Introduced
63f5e576856d339a408c170461604f271cd03a5d
Fixed
66fd76a9f36213cb4e2bb41bf44653f15af26d6c
Introduced
407408e9a83d2ba09cf4229672cb1cac61f30876
Last Affected
407408e9a83d2ba09cf4229672cb1cac61f30876
Database specific
Show details 
{
    "cpe": [
        "cpe:2.3:a:freeipa:freeipa:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:freeipa:freeipa:4.12.0:*:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "4.11.0"
        },
        {
            "fixed": "4.11.2"
        },
        {
            "introduced": "4.12.0"
        },
        {
            "last_affected": "4.12.0"
        }
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ]
}

Affected versions

4.*
4.12.0
Other
release-4-11-0
release-4-11-1
release-4-12-0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-2698.json"