FreeIPA API Audit Credential Leak Vulnerability

A vulnerability exists in the FreeIPA API audit process, where the complete FreeIPA command line is sent to journalctl. This behavior unintentionally exposes administrative user credentials, including passwords, to the journal database during the FreeIPA installation. In scenarios where journal logs are centralized, this could lead to unauthorized access to FreeIPA administrator credentials.

Impact

Exploitation of this vulnerability allows for the unauthorized disclosure of FreeIPA administrative credentials, including passwords, which could be misused to gain improper access to administrative functions.

Remediation

Users can apply the available update for Red Hat Enterprise Linux 9, which addresses this vulnerability. For instructions on how to apply this update, refer to the Red Hat Enterprise Linux 9 Update Guide.