# PYSEC-2014-103 - The default LDAP ACIs in FreeIPA 3.0 before 3.1.2 do not restrict access to the (1)…

Source: https://junglewise.ai/threats/pysec-2014-103-the-default-ldap-acis-in-freeipa-3-0-before-3-1-2-do-not-48127a2e  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2014-05-29  
License: CC BY 4.0 with a link back

Severity: info · Published 2014-05-29

The default LDAP ACIs in FreeIPA 3.0 before 3.1.2 do not restrict access to the (1) ipaNTTrustAuthIncoming and (2) ipaNTTrustAuthOutgoing attributes, which allow remote attackers to obtain the Cross-Realm Kerberos Trust key via unspecified vectors.

Technologies: [ipa (PyPI)](https://junglewise.ai/threats/technologies/ipa). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Informational severity, published 29 May 2014.

**Which products and versions are affected?** ipa (PyPI) ECOSYSTEM:introduced=0.

**Is there a fix for This vulnerability?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected?** Check whether you run ipa (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- ipa (PyPI) ECOSYSTEM:introduced=0

## Related threats

- [PYSEC-2026-636 - Code injection in FreeIPA](https://junglewise.ai/threats/cve-2019-14867-code-injection-in-freeipa)
- [PYSEC-2019-98 - A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all…](https://junglewise.ai/threats/pysec-2019-98-a-flaw-was-found-in-ipa-all-4-6-x-versions-before-4-6-7-da647549)
- [FreeIPA logs passwords embedded in commands in calls using batch](https://junglewise.ai/threats/cve-2019-10195-freeipa-logs-passwords-embedded-in-commands-in-calls-using-batch)
- [PYSEC-2014-104 - FreeIPA 4.0.x before 4.0.5 and 4.1.x before 4.1.1, when 2FA is enabled, allows remote attackers to…](https://junglewise.ai/threats/pysec-2014-104-freeipa-4-0-x-before-4-0-5-and-4-1-x-before-4-1-1-when-577ccebb)
- [PYSEC-2013-38 - The client in FreeIPA 2.x and 3.x before 3.1.2 does not properly obtain the Certification Authority…](https://junglewise.ai/threats/cve-2012-5484-pysec-2013-36-the-client-in-freeipa-2-x-and-3-x-before-3-1-2-does)