BSD PortsFreeIPA -- multiple vulnerabilities
· CVE-2026-11861, CVE-2026-13097, CVE-2026-19550, CVE-2026-73196, CVE-2026-73197, CVE-2026-73198, CVE-2026-73199, CVE-2026-76578, CVE-2026-79678 · VuXML entry
The FreeIPA project reports: CVE-2026-76578: the access control instruction for self-managed OTP tokens requires no authentication and does not restrict which attributes may be written alongside the token entry. An unauthenticated LDAP client can create a Kerberos principal and add it to the administrators group. CVE-2026-79678: insufficiently validated --organization and --base-url input to idp-add reaches a …
Affected versions
- freeipa-server < 4.13.4
By system
0 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| FreeBSD | net/freeipa-server | 4.13.4 | fixed |