Medium severity6.5NVD Advisory· Published Sep 7, 2016· Updated May 6, 2026
CVE-2016-5404
CVE-2016-5404
Description
The cert_revoke command in FreeIPA does not check for the "revoke certificate" permission, which allows remote authenticated users to revoke arbitrary certificates by leveraging the "retrieve certificate" permission.
Affected products
6cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:24:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:25:*:*:*:*:*:*:*
cpe:2.3:o:oracle:linux:6:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:oracle:linux:6:*:*:*:*:*:*:*
- cpe:2.3:o:oracle:linux:7:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
9- git.fedorahosted.org/cgit/freeipa.git/commit/nvdIssue TrackingPatch
- www.openwall.com/lists/oss-security/2016/08/17/9nvdMailing ListThird Party Advisory
- www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.htmlnvdThird Party Advisory
- www.securityfocus.com/bid/92525nvdThird Party AdvisoryVDB Entry
- fedorahosted.org/freeipa/ticket/6232nvdIssue Tracking
- rhn.redhat.com/errata/RHSA-2016-1797.htmlnvd
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3PZ2ZQTMGC2UBRNHXVVOY3PJDOBP4CP4/nvd
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S5OROLKFSY5QRQS7NGBNDP5QMOBV3XMZ/nvd
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VQDYWANTMDFZP3HTGSEOA2IONVUITYX5/nvd
News mentions
0No linked articles in our index yet.