CVE-2015-5284

Critical

Published: 21/09/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

In FreeIPA before version 4.2.2, the ipa-kra-install script places the CA agent certificate and private key in /etc/httpd/alias/kra-agent.pem, which is world readable.

Risk Assessment

The availability of the private key to all users may lead to unauthorized access to resources secured by this certificate, posing a serious security threat to the organization.

Recommendation

It is recommended to restrict permissions on the kra-agent.pem file so that only authorized users can read it, and consider upgrading to a newer version of FreeIPA.

Original NVD description (English source)

ipa-kra-install in FreeIPA before 4.2.2 puts the CA agent certificate and private key in /etc/httpd/alias/kra-agent.pem, which is world readable.