cve.bz

CVE-2019-14867

8.8 highEPSS 7.4%

High (8.8). EPSS 7.4% chance of exploitation in the next 30 days. Fixed in ipa 4.6.7, 4.7.4, 4.8.3.

A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way the internal function ber_scanf() was used in some components of the IPA server, which parsed kerberos key data. An unauthenticated attacker who could trigger parsing of the krb principal key could cause the IPA server to crash or in some conditions, cause arbitrary code to be executed on the server hosting the IPA server.

Severity

CVSS 3.1

8.8 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS
7.4% chance of exploitation in the next 30 days; higher than 94% of CVEs (scores of 2026-10-31)
CWEs
CWE-94, CWE-400
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-7hpj-hfcr-5qwmPyPIipa>=4.6.2 <4.6.74.6.7
GHSA-7hpj-hfcr-5qwmPyPIipa>=4.7.0 <4.7.44.7.4
GHSA-7hpj-hfcr-5qwmPyPIipa>=4.8.0 <4.8.34.8.3
GHSA-7hpj-hfcr-5qwmPyPIfreeipa>=4.6.2 <4.6.74.6.7
GHSA-7hpj-hfcr-5qwmPyPIfreeipa>=4.7.0 <4.7.44.7.4
GHSA-7hpj-hfcr-5qwmPyPIfreeipa>=4.8.0 <4.8.34.8.3
PYSEC-2019-28PyPIipa>=4.6.2 <4.6.7
>=4.7.0 <4.7.4
>=4.8.0 <4.8.3		4.6.7, 4.7.4, 4.8.3
PYSEC-2026-636PyPIfreeipa>=4.6.2 <4.6.7
>=4.7.0 <4.7.4
>=4.8.0 <4.8.3		4.6.7, 4.7.4, 4.8.3

References

Check your stackJSON