DEBIAN-CVE-2025-7493

See a problem?
Please try reporting it to the source first.

Source

https://security-tracker.debian.org/tracker/CVE-2025-7493

Import Source

https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-7493.json

JSON Data

https://api.osv.dev/v1/vulns/DEBIAN-CVE-2025-7493

Upstream

CVE-2025-7493

Published

2025-09-30T15:15:58Z

Modified

2026-09-01T20:05:58Z

Severity

9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

A privilege escalation flaw from host to domain administrator was found in FreeIPA. This vulnerability is similar to CVE-2025-4404, where it fails to validate the uniqueness of the krbCanonicalName. While the previously released version added validations for the admin@REALM credential, FreeIPA still does not validate the root@REALM canonical name, which can also be used as the realm administrator's name. This flaw allows an attacker to perform administrative tasks over the REALM, leading to access to sensitive data and sensitive data exfiltration.

References

https://security-tracker.debian.org/tracker/CVE-2025-7493

Affected packages

Debian:12 / freeipa

Package

Name: freeipa
Purl: pkg:deb/debian/freeipa?arch=source&distro=bookworm

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

4.*

4.9.11-1

4.9.11-1+exp1

4.9.11-2

4.10.1-1+exp1

4.10.1+dfsg1-1+exp1

4.10.2-1

4.10.2-2

4.10.2-2+exp1

4.11.1-1

4.11.1-1+exp1

4.11.1-2

4.11.1-2+exp1

4.11.1-2.1

4.12.2-1

4.12.2-2

4.12.2-3

4.12.4-1

4.12.4-2

4.13.1-1

Ecosystem specific

{
    "urgency": "unimportant"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-7493.json"

Debian:13 / freeipa