CVEvulnerability

CVE-2020-1722

5.3 MEDIUM Published 2020-04-27 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2020-04-27
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.3 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 3.1 ([email protected])
5.3 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0 ([email protected])
5.4 MEDIUM — AV:N/AC:H/Au:N/C:N/I:N/A:C
Weaknesses
CWE-400

Description

A flaw was found in all ipa versions 4.x.x through 4.8.0. When sending a very long password (>= 1,000,000 characters) to the server, the password hashing process could exhaust memory and CPU leading to a denial of service and the website becoming unresponsive. The highest threat from this vulnerability is to system availability.

Affected configurations

• freeipa freeipa (>= 4.0.0 <= 4.8.0) • redhat enterprise linux 6.0 • redhat enterprise linux 7.0 • redhat enterprise linux 8.0

Related

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References