CVE-2019-10195

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-11-27 · updated 2026-06-17
Weakness: CWE-200

Description

A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way that FreeIPA's batch processing API logged operations. This included passing user passwords in clear text on FreeIPA masters. Batch processing of commands with passwords as arguments or options is not performed by default in FreeIPA but is possible by third-party components. An attacker having access to system logs on FreeIPA masters could use this flaw to produce log file content with passwords exposed.

Affected products

Fedoraproject Fedora: 30, 31
FreeIPA ipa: from 4.6.0 before 4.6.7; from 4.7.0 before 4.7.4; from 4.8.0 before 4.8.3 — fixed in 4.6.7, 4.7.4, 4.8.3

How to fix

Upgrade to a fixed version: FreeIPA ipa 4.6.7, 4.7.4, 4.8.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-10195 or the next vulnerability affects your stack