Anolis OS update for ipa
| Risk | Low |
| Patch available | YES |
| Number of vulnerabilities | 1 |
| CVE-ID | CVE-2024-3183 |
| CWE-ID | CWE-916 |
| Exploitation vector | Network |
| Public exploit | Public exploit code for vulnerability #1 is available. |
| Vulnerable software |
Anolis OS Operating systems & Components / Operating system ipa-python-compat Operating systems & Components / Operating system package or component python2-ipaserver Operating systems & Components / Operating system package or component python2-ipalib Operating systems & Components / Operating system package or component python2-ipaclient Operating systems & Components / Operating system package or component ipa-server-dns Operating systems & Components / Operating system package or component ipa-server-common Operating systems & Components / Operating system package or component ipa-common Operating systems & Components / Operating system package or component ipa-client-common Operating systems & Components / Operating system package or component ipa-server-trust-ad Operating systems & Components / Operating system package or component ipa-server Operating systems & Components / Operating system package or component ipa-client Operating systems & Components / Operating system package or component |
| Vendor | OpenAnolis |
Security Bulletin
This security bulletin contains one low risk vulnerability.
1) Use of Password Hash With Insufficient Computational Effort
EUVDB-ID: #VU92249
Risk: Low
CVSSv4.0: 2.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/U:Clear]
CVE-ID: CVE-2024-3183
CWE-ID:
CWE-916 - Use of Password Hash With Insufficient Computational Effort
Exploit availability: Yes
DescriptionThe vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to software uses principal key to encrypt tickets. A remote attacker can brute-force the principal key and decrypt communication between KDC and the client.
Install updates from vendor's repository.
Vulnerable software versionsAnolis OS: 7
ipa-python-compat: before 4.6.8-5.0.1
python2-ipaserver: before 4.6.8-5.0.1
python2-ipalib: before 4.6.8-5.0.1
python2-ipaclient: before 4.6.8-5.0.1
ipa-server-dns: before 4.6.8-5.0.1
ipa-server-common: before 4.6.8-5.0.1
ipa-common: before 4.6.8-5.0.1
ipa-client-common: before 4.6.8-5.0.1
ipa-server-trust-ad: before 4.6.8-5.0.1
ipa-server: before 4.6.8-5.0.1
ipa-client: before 4.6.8-5.0.1
CPE2.3- cpe:2.3:o:openanolis:anolis_os:7:*:*:*:*:*:*:*
- cpe:2.3:a:openanolis:ipa-python-compat:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:a:openanolis:python2-ipaserver:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:a:openanolis:python2-ipalib:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:a:openanolis:python2-ipaclient:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:a:openanolis:ipa-server-dns:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:a:openanolis:ipa-server-common:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:a:openanolis:ipa-common:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:a:openanolis:ipa-client-common:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:a:openanolis:ipa-server-trust-ad:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:a:openanolis:ipa-server:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:a:openanolis:ipa-client:*:*:*:*:*:anolis_os:*:*
https://anas.openanolis.cn/errata/detail/ANSA-2024:0522
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
