Skip to content
Fencer Intel
medium 5.7

CVE-2019-10195 json

FreeIPA logs passwords embedded in commands in calls using batch

published 2019-11-27 6 y ago modified 2026-06-17 4 mo ago also GHSA-w4q7-f34x-vpgc , PYSEC-2019-168 , PYSEC-2019-22 , EUVD-2019-0056

cvss
5.7
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.8%
EPSS 1.8% chance of exploitation in 30 days, percentile 78%
public exploits
0
none known

Summary

A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way that FreeIPA's batch processing API logged operations. This included passing user passwords in clear text on FreeIPA masters. Batch processing of commands with passwords as arguments or options is not performed by default in FreeIPA but is possible by third-party components. An attacker having access to system logs on FreeIPA masters could use this flaw to produce log file content with passwords exposed.

Patch / fix

  • pypi freeipa 4.6.7, 4.7.4, 4.8.3
  • pypi ipa 4.6.7, 4.7.4, 4.8.3
  • freeipa freeipa 4.6.7, 4.7.4, 4.8.3
  • freeipa Debian 14, Debian 13, Debian 12 4.8.3-1

debian advisories DEBIAN-CVE-2019-10195

  • ipa RHEL 8 4.8.0-13.module+el8.1.0+4923+c6efe041
  • pyusb RHEL 8 1.0.0-9.module+el8.1.0+4098+f286395e
  • softhsm RHEL 8 2.4.0-2.module+el8.1.0+4098+f286395e
  • custodia RHEL 8 0.6.0-3.module+el8.1.0+4098+f286395e
  • slapi-nis RHEL 8 0.56.3-2.module+el8.1.0+4098+f286395e
  • ipa-client RHEL 8 4.8.0-13.module+el8.1.0+4923+c6efe041
  • ipa-common RHEL 8 4.8.0-13.module+el8.1.0+4923+c6efe041
  • ipa-server RHEL 8 4.8.0-13.module+el8.1.0+4923+c6efe041

red hat advisories RHSA-2020:1269RHBA-2019:4268RHSA-2020:0378

  • custodia AlmaLinux 8 0.6.0-3.module_el8.6.0+2881+2f24dc92
  • custodia AlmaLinux 8 0.6.0-3.module_el8.5.0+2603+92118e57
  • python3-pyusb AlmaLinux 8 1.0.0-9.module_el8.5.0+2603+92118e57
  • python3-pyusb AlmaLinux 8 1.0.0-9.module_el8.6.0+2881+2f24dc92
  • python3-pyusb AlmaLinux 8 1.0.0-9.module_el8.6.0+2737+7e73ea90
  • python3-qrcode AlmaLinux 8 5.1-12.module_el8.5.0+2603+92118e57
  • python3-qrcode AlmaLinux 8 5.1-12.module_el8.6.0+2881+2f24dc92
  • python3-qrcode AlmaLinux 8 5.1-12.module_el8.6.0+2737+7e73ea90

almalinux advisories ALBA-2019:4268

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-10195 updated cvss 5.7

ipa: Batch API logging user passwords to /var/log/httpd/error_log

  • Red Hat Enterprise Linux 6 ipa, ipa-client, ipa-python, ipa-server, ipa-admintools, ipa-server-selinux, +1 more
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux AppStream (v. 8) ipa 4.8.0-13.module+el8.1.0+4923+c6efe041, pyusb 1.0.0-9.module+el8.1.0+4098+f286395e, softhsm 2.4.0-2.module+el8.1.0+4098+f286395e, custodia 0.6.0-3.module+el8.1.0+4098+f286395e, slapi-nis 0.56.3-2.module+el8.1.0+4098+f286395e, ipa-client 4.8.0-13.module+el8.1.0+4923+c6efe041, +27 more
    fixed: vendor fix RHBA-2019:4268
  • Red Hat Enterprise Linux AppStream E4S (v. 8.0) pyusb 1.0.0-9.module+el8+2555+b334d87b, softhsm 2.4.0-2.module+el8+2555+b334d87b, custodia 0.6.0-2.module+el8+2555+b334d87b, ipa 4.7.1-12.module+el8.0.0+5776+863ecd37, slapi-nis 0.56.2-7.module+el8+2555+b334d87b, opendnssec 1.4.14-1.module+el8+2555+b334d87b, +25 more
    fixed: vendor fix RHSA-2020:1269
  • Red Hat Enterprise Linux Client (v. 7) ipa 4.6.5-11.el7_7.4, ipa-client 4.6.5-11.el7_7.4, ipa-common 4.6.5-11.el7_7.4, python2-ipalib 4.6.5-11.el7_7.4, ipa-client-common 4.6.5-11.el7_7.4, ipa-python-compat 4.6.5-11.el7_7.4, +1 more Red Hat Enterprise Linux Client Optional (v. 7) ipa-server 4.6.5-11.el7_7.4, ipa-server-dns 4.6.5-11.el7_7.4, ipa-server-common 4.6.5-11.el7_7.4, python2-ipaserver 4.6.5-11.el7_7.4, ipa-server-trust-ad 4.6.5-11.el7_7.4 Red Hat Enterprise Linux ComputeNode (v. 7) ipa 4.6.5-11.el7_7.4, ipa-client 4.6.5-11.el7_7.4, ipa-common 4.6.5-11.el7_7.4, python2-ipalib 4.6.5-11.el7_7.4, ipa-client-common 4.6.5-11.el7_7.4, ipa-python-compat 4.6.5-11.el7_7.4, +1 more Red Hat Enterprise Linux ComputeNode Optional (v. 7) ipa-server 4.6.5-11.el7_7.4, ipa-server-dns 4.6.5-11.el7_7.4, ipa-server-common 4.6.5-11.el7_7.4, python2-ipaserver 4.6.5-11.el7_7.4, ipa-server-trust-ad 4.6.5-11.el7_7.4 Red Hat Enterprise Linux Server (v. 7) ipa 4.6.5-11.el7_7.4, ipa-client 4.6.5-11.el7_7.4, ipa-common 4.6.5-11.el7_7.4, ipa-server 4.6.5-11.el7_7.4, ipa-server-dns 4.6.5-11.el7_7.4, python2-ipalib 4.6.5-11.el7_7.4, +6 more Red Hat Enterprise Linux Workstation (v. 7) ipa 4.6.5-11.el7_7.4, ipa-client 4.6.5-11.el7_7.4, ipa-common 4.6.5-11.el7_7.4, ipa-server 4.6.5-11.el7_7.4, ipa-server-dns 4.6.5-11.el7_7.4, python2-ipalib 4.6.5-11.el7_7.4, +6 more
    fixed: vendor fix RHSA-2020:0378
  • Red Hat Enterprise Linux 8 ipa, ipa-client, ipa-common, ipa-server, ipa-selinux, ipa-client-epn, +10 more Red Hat Virtualization 4 redhat-virtualization-host-image-update
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.81% chance of exploitation in the next 30 days, higher than 78% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.0 5.7 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
NVD 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD 2.0 4.0 AV:N/AC:L/Au:S/C:P/I:N/A:N
GitHub 3.0 5.7 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
pypi freeipa
>=4.6.0, <4.6.7
>=4.7.0, <4.7.4
>=4.8.0, <4.8.3
>=4.6.1, <4.6.7
4.6.7
4.7.4
4.8.3
pypi ipa
>=4.6.0, <4.6.7
>=4.7.0, <4.7.4
>=4.8.0, <4.8.3
4.6.7
4.7.4
4.8.3

Affected products

  • Red Hat IPA

Classification

Weakness
  • CWE-532 Insertion of Sensitive Information into Log File
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.