VYPR
← All advisories
Moderate severityNVD Advisory· Published Nov 27, 2019· Updated Aug 4, 2024

CVE-2019-10195

CVE-2019-10195

Description

A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way that FreeIPA's batch processing API logged operations. This included passing user passwords in clear text on FreeIPA masters. Batch processing of commands with passwords as arguments or options is not performed by default in FreeIPA but is possible by third-party components. An attacker having access to system logs on FreeIPA masters could use this flaw to produce log file content with passwords exposed.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
freeipaPyPI
>= 4.6.0, < 4.6.74.6.7
freeipaPyPI
>= 4.7.0, < 4.7.44.7.4
freeipaPyPI
>= 4.8.0, < 4.8.34.8.3
ipaPyPI
>= 4.6.0, < 4.6.74.6.7
ipaPyPI
>= 4.7.0, < 4.7.44.7.4
ipaPyPI
>= 4.8.0, < 4.8.34.8.3

Affected products

3
  • ghsa-coords2 versions
    pkg:pypi/freeipapkg:pypi/ipa
    >= 4.6.0, < 4.6.7+ 1 more
    • (no CPE)range: >= 4.6.0, < 4.6.7
    • (no CPE)range: >= 4.6.0, < 4.6.7
  • Red Hat/IPAv5
    Range: all IPA 4.6.x versions before 4.6.7

Patches

Vulnerability mechanics

Root cause

"FreeIPA's batch API logs all sub-command parameters, including passwords, in cleartext to the system log before the individual commands mask them."

Attack vector

An attacker with access to system logs on a FreeIPA master can read cleartext passwords from `/var/log/httpd/error_log`. The batch API logs all sub-command parameters, including sensitive ones like passwords, before the individual commands mask them out. Batch processing is not used by default but can be invoked by third-party components [CWE-200] [ref_id=1].

Affected code

FreeIPA's batch processing API (`batch` plugin) logs all parameters of sub-commands, including passwords, to `/var/log/httpd/error_log`. The flaw affects FreeIPA 4.6.x before 4.6.7, 4.7.x before 4.7.4, and 4.8.x before 4.8.3. Only the server component is vulnerable; client packages are not affected [ref_id=1].

What the fix does

The patch (tested successfully by the developer) ensures that passwords are masked in the batch command log output, matching the masking already applied when individual commands are processed. The fix was contributed by the reporter and improved by the FreeIPA team to log more information while still protecting secrets [ref_id=1].

Preconditions

  • authAttacker must have read access to /var/log/httpd/error_log on a FreeIPA master
  • inputA third-party component must invoke the batch API with a password argument

Generated on Jun 1, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

15

News mentions

0

No linked articles in our index yet.