Back to Database
Status published
Medium
CVE-2015-1827
The get_user_grouplist function in the extdom plug-in in FreeIPA before...
Vulnerability Description
The get_user_grouplist function in the extdom plug-in in FreeIPA before 4.1.4 does not properly reallocate memory when processing user accounts, which allows remote attackers to cause a denial of service (crash) via a group list request for a user that belongs to a large number of groups.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2015-1827
Credits & Attribution
No credits recorded in the NVD database.
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1205200
- http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154314.html
- https://fedorahosted.org/freeipa/ticket/4908
- http://www.securityfocus.com/bid/73376
- http://lists.fedoraproject.org/pipermail/package-announce/2015-March/154103.html
- http://rhn.redhat.com/errata/RHSA-2015-0728.html
More from freeipa
View All →CVE-2017-11191
FreeIPA 4.x with API version 2.213 allows a remote authenticated...
High
8.8
CVE-2016-7030
FreeIPA uses a default password policy that locks an account...
High
7.5
CVE-2016-5414
FreeIPA 4.4.0 allows remote attackers to request an arbitrary SAN...
High
7.5
CVE-2016-5404
The cert_revoke command in FreeIPA does not check for the...
Medium
6.5
CVE-2015-5284
ipa-kra-install in FreeIPA before 4.2.2 puts the CA agent certificate...
Critical
9.8
Affected Vendor
freeipa
View all reports →Affected Software
freeipa, fedora
Vulnerable Versions:
0, 21, 22
Timeline
Official Publish:
March 30th, 2015
Last Modified:
August 6th, 2024
Added to House:
July 19th, 2026
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.