{"id":"UBUNTU-CVE-2017-11191","details":"** DISPUTED ** FreeIPA 4.x with API version 2.213 allows a remote authenticated users to bypass intended account-locking restrictions via an unlock action with an old session ID (for the same user account) that had been created for an earlier session. NOTE: Vendor states that issue does not exist in product and does not recognize this report as a valid security concern.","modified":"2017-09-28T01:29:00Z","published":"2017-09-28T01:29:00Z","withdrawn":"2025-06-23T15:52:58Z","references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2017-11191"},{"type":"REPORT","url":"http://packetstormsecurity.com/files/143532/FreeIPA-2.213-Session-Hijacking.html"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2017-11191"}],"affected":[{"package":{"name":"freeipa","ecosystem":"Ubuntu:Pro:14.04:LTS","purl":"pkg:deb/ubuntu/freeipa"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.1-0ubuntu1","3.3.4-0ubuntu1","3.3.4-0ubuntu2","3.3.4-0ubuntu3","3.3.4-0ubuntu3.1","3.3.4-0ubuntu3.1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2017/UBUNTU-CVE-2017-11191.json"}},{"package":{"name":"freeipa","ecosystem":"Ubuntu:Pro:16.04:LTS","purl":"pkg:deb/ubuntu/freeipa"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.4-1","4.3.1-0ubuntu1","4.3.1-0ubuntu1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2017/UBUNTU-CVE-2017-11191.json"}},{"package":{"name":"freeipa","ecosystem":"Ubuntu:Pro:18.04:LTS","purl":"pkg:deb/ubuntu/freeipa"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.4-3ubuntu1","4.4.4-4","4.7.0~pre1+git20180411-2ubuntu1","4.7.0~pre1+git20180411-2ubuntu2"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2017/UBUNTU-CVE-2017-11191.json"}},{"package":{"name":"freeipa","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/freeipa"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.1-2ubuntu1","4.8.3-1","4.8.6-1ubuntu2"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2017/UBUNTU-CVE-2017-11191.json"}},{"package":{"name":"freeipa","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/freeipa"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.6-1ubuntu6","4.8.6-1ubuntu8","4.8.6-1ubuntu9","4.9.8-1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2017/UBUNTU-CVE-2017-11191.json"}},{"package":{"name":"freeipa","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/freeipa"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.10.2-1","4.10.2-2","4.10.2-2ubuntu3","4.11.1-1","4.11.1-2"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2017/UBUNTU-CVE-2017-11191.json"}}],"schema_version":"1.7.3","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}