CVE-2025-24034

Source
https://nvd.nist.gov/vuln/detail/CVE-2025-24034
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-24034.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-24034
Aliases
  • GHSA-p989-2f5w-9cf6
Published
2025-01-23T18:15:33Z
Modified
2025-01-28T07:56:56.341854Z
Summary
[none]
Details

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Starting in version 0.7.0 and prior to versions 0.7.15 and 0.8.3, Himmelblau is vulnerable to leaking credentials in debug logs. When debug logging is enabled, user access tokens are inadvertently logged, potentially exposing sensitive authentication data. Similarly, Kerberos Ticket-Granting Tickets (TGTs) are logged when debug logging is enabled. Both issues pose a risk of exposing sensitive credentials, particularly in environments where debug logging is enabled. Himmelblau versions 0.7.15 and 0.8.3 contain a patch that fixes both issues. Some workarounds are available for users who are unable to upgrade. For the logon compliance script issue, disable the logon_script option in /etc/himmelblau/himmelblau.conf, and avoid using the -d flag when starting the himmelblaud daemon. For the Kerberos CCache issue, one may disable debug logging globally by setting the debug option in /etc/himmelblau/himmelblau.conf to false and avoiding the -d parameter when starting himmelblaud.

References

Affected packages

Git / github.com/himmelblau-idm/himmelblau

Affected ranges

Type
GIT
Repo
https://github.com/himmelblau-idm/himmelblau
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed

Affected versions

0.*

0.0.1
0.0.2
0.0.3
0.0.4
0.1.0
0.2.0
0.5.0
0.5.3
0.6.0
0.6.1
0.7.0