products / freeipa

FreeIPA

FreeIPA is Red Hat's integrated identity stack for Linux environments. A single deployment combines 389 Directory Server (LDAP), MIT Kerberos, BIND DNS with dynamic updates, Dogtag PKI, and an Apache-based management UI and JSON-RPC API. Enterprises use it as a central realm for host enrollment, sudo rules, HBAC, and certificate issuance on RHEL and related distributions. NVD tracks the product as freeipa:freeipa. Advisories often sit at the Kerberos, KRA, or management API boundary rather than in a single daemon.

api usage

Querying FreeIPA

product slugfreeipa

version format4.9.8, 4.12.0, 4.10.1

bash

curl "https://api.attestd.io/v1/check?product=freeipa&version=4.9.8" \
  -H "Authorization: Bearer $ATTESTD_KEY"

FreeIPA 4.9.8 returns risk_state: "high" with CVE-2024-2698 in cve_ids and authentication-bypass risk factors in the aggregated response.

json

{
  "product": "freeipa",
  "version": "4.9.8",
  "supported": true,
  "risk_state": "high",
  "risk_factors": [
    "remote_code_execution",
    "no_authentication_required",
    "internet_exposed_service",
    "patch_available"
  ],
  "actively_exploited": false,
  "remote_exploitable": true,
  "authentication_required": false,
  "patch_available": true,
  "fixed_version": "4.9.14",
  "confidence": 0.5,
  "cve_ids": [
    "CVE-2023-5455"
  ],
  "cves": null,
  "max_epss": 0.0057,
  "last_updated": "2026-07-08T18:22:49.727382Z",
  "supply_chain": null,
  "supply_chain_monitored": false,
  "typosquat": null
}

safe version

FreeIPA 4.12.0 is a current 4.12 line release for comparison against the 4.9.8 example. Check the MS-SFU advisory ranges below before treating any 4.12.0 build as fully patched for CVE-2024-2698.

bash

curl "https://api.attestd.io/v1/check?product=freeipa&version=4.12.0" \
  -H "Authorization: Bearer $ATTESTD_KEY"

notable cves

CVE history

FreeIPA CVEs concentrate on Kerberos privilege paths, installer credential handling, and authenticated API session logic. Because the product owns realm keys and CA material, a single flawed install step or ticket flag check can escalate across the identity plane.

CVE	Description	Affects	CVSS
`CVE-2024-2698`	Incomplete MS-SFU / S4U2Self forwardable-flag handling enables Kerberos privilege escalation.	≥4.11.0 <4.11.2, 4.12.0	8.8
`CVE-2015-5284`	ipa-kra-install writes the CA agent cert and key world-readable under /etc/httpd/alias/kra-agent.pem.	≤4.2.1	9.8
`CVE-2017-11191`	Authenticated unlock with a stale session ID bypasses account-lock restrictions.	FreeIPA 4.x API	8.8

KEV = CISA Known Exploited Vulnerabilities catalog. Active exploitation confirmed.

data sources

FreeIPA CPE namespace

NVD records FreeIPA product CVEs under a single CPE vendor/product pair even though a deployment also runs LDAP, Kerberos, and PKI components with their own CPE families:

cpe:2.3:a:freeipa:freeipaFreeIPA package and management-plane CVEs

Attestd maps freeipa to this CPE. Query related products such as mit_kerberos or openldap separately when you need component-level coverage.

All products MIT Kerberos OpenLDAP Quickstart