CVE-2012-5484: PYSEC-2013-38 - The client in FreeIPA 2.x and 3.x before 3.1.2 does not properly obtain the Certification Authority…

CVE-2012-5484 · Severity: info · Published 2013-01-27

The client in FreeIPA 2.x and 3.x before 3.1.2 does not properly obtain the Certification Authority (CA) certificate from the server, which allows man-in-the-middle attackers to spoof a join procedure via a crafted certificate.

Technologies: freeipa (PyPI), ipa (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2012-5484 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2012-5484 being exploited in the wild.
How severe is CVE-2012-5484?
Informational severity, published 27 January 2013.
Which products and versions are affected?
freeipa (PyPI) GIT:introduced=0,fixed=91f4af7e6af53e1c6bf17ed36cb2161863eddae4,fixed=18eea90ebb24a9c22248f0b7e18646cc6e3e3e0f,fixed=a1991aeac19c3fec1fdd0d184c6760c90c9f9fc9,fixed=31e41eea6c2322689826e6065ceba82551c565aa,fixed=a40285c5a0288669b72f9d991508d4405885bffc|ECOSYSTEM:introduced=0; ipa (PyPI) GIT:introduced=0,fixed=91f4af7e6af53e1c6bf17ed36cb2161863eddae4,fixed=18eea90ebb24a9c22248f0b7e18646cc6e3e3e0f,fixed=a1991aeac19c3fec1fdd0d184c6760c90c9f9fc9,fixed=31e41eea6c2322689826e6065ceba82551c565aa,fixed=a40285c5a0288669b72f9d991508d4405885bffc|ECOSYSTEM:introduced=0.
Is there a fix for CVE-2012-5484?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
Am I affected by CVE-2012-5484?
Check whether you run freeipa (PyPI) or ipa (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Affected products

  • freeipa (PyPI) GIT:introduced=0,fixed=91f4af7e6af53e1c6bf17ed36cb2161863eddae4,fixed=18eea90ebb24a9c22248f0b7e18646cc6e3e3e0f,fixed=a1991aeac19c3fec1fdd0d184c6760c90c9f9fc9,fixed=31e41eea6c2322689826e6065ceba82551c565aa,fixed=a40285c5a0288669b72f9d991508d4405885bffc|ECOSYSTEM:introduced=0
  • ipa (PyPI) GIT:introduced=0,fixed=91f4af7e6af53e1c6bf17ed36cb2161863eddae4,fixed=18eea90ebb24a9c22248f0b7e18646cc6e3e3e0f,fixed=a1991aeac19c3fec1fdd0d184c6760c90c9f9fc9,fixed=31e41eea6c2322689826e6065ceba82551c565aa,fixed=a40285c5a0288669b72f9d991508d4405885bffc|ECOSYSTEM:introduced=0

Identifiers

  • CVE-2012-5484
  • PYSEC-2013-36
  • PYSEC-2013-38

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.