Red Hat Product Errata RHSA-2025:17087 - Security Advisory
Issued:
2025-09-30
Updated:
2025-09-30

RHSA-2025:17087 - Security Advisory

Synopsis

Important: ipa security update

Type/Severity

Security Advisory: Important

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for ipa is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments.

Security Fix(es):

  • FreeIPA: idm: Privilege escalation from host to domain admin in FreeIPA (CVE-2025-7493)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux Server - AUS 9.2 x86_64
  • Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.2 ppc64le
  • Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.2 x86_64
  • Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.2 aarch64
  • Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.2 s390x

Fixes

  • BZ - 2389448 - CVE-2025-7493 FreeIPA: idm: Privilege escalation from host to domain admin in FreeIPA

Red Hat Enterprise Linux Server - AUS 9.2

SRPM
ipa-4.10.1-12.el9_2.6.src.rpm SHA-256: 61526e4e09e03b0b550cd11559a21653ec0ef4aa3e419986ea2adc1e19df9193
x86_64
ipa-client-4.10.1-12.el9_2.6.x86_64.rpm SHA-256: 318f9f27f49a280f9e5584c2443bf9f8be19bee7d4e7c4671ec71cf4a97531e6
ipa-client-common-4.10.1-12.el9_2.6.noarch.rpm SHA-256: 1f92bb5387334ab19b1a3eff9b2c18fd05de2adc2d537d63866f132182b05bfc
ipa-client-debuginfo-4.10.1-12.el9_2.6.x86_64.rpm SHA-256: 5f994d3e82533c16d3ba5da380fffca2d27809b7d2c90a1237d6ae56be3c86f8
ipa-client-epn-4.10.1-12.el9_2.6.x86_64.rpm SHA-256: a9257ca8401e3c7ff9c73c244705278cabb2c6ba33974ae7579358b52e03bc04
ipa-client-samba-4.10.1-12.el9_2.6.x86_64.rpm SHA-256: 78dbb473359cae4f21fc30e0782df36756377e0c355ffc2f704387fb9ff3c968
ipa-common-4.10.1-12.el9_2.6.noarch.rpm SHA-256: 916a97e67e005c19c6e2b7099a18da2a98048b770c6f44607fba02c0865411fa
ipa-debuginfo-4.10.1-12.el9_2.6.x86_64.rpm SHA-256: ac5c72db3ab67f8f2cf2d0eb4aa80e50238ae3ebefc95caae51e31ba2f777b7c
ipa-debugsource-4.10.1-12.el9_2.6.x86_64.rpm SHA-256: c82f982e4481422a535b6fc8fd23ffb918a205411edd9843d28c4debe9c8a67d
ipa-selinux-4.10.1-12.el9_2.6.noarch.rpm SHA-256: c6ebc27774ad0ad9205ec609d525c4587414ae73dd4a8184ab892b9e5073e6f1
ipa-server-4.10.1-12.el9_2.6.x86_64.rpm SHA-256: 74a05f7519af05d0e9f6e1f238e9fb60425d657a729e2c2ec747822204ad7bd9
ipa-server-common-4.10.1-12.el9_2.6.noarch.rpm SHA-256: ed74884bcd3ae74cf89b6e66dfa60068be08786efdfdf6e5735ed16820514475
ipa-server-debuginfo-4.10.1-12.el9_2.6.x86_64.rpm SHA-256: 419ac6a02984bd7bcb1082c3a5fe0375a727de047caaec4e94423b084a11cd9d
ipa-server-dns-4.10.1-12.el9_2.6.noarch.rpm SHA-256: 355d58c264afd63a3468f03f56eed071a0abff7e46fbeb8e76de119055c453d6
ipa-server-trust-ad-4.10.1-12.el9_2.6.x86_64.rpm SHA-256: ebd94403554c1ec6f77fe36f5f3dfcd0fe62e7aee5a89c8878315d2de2e798e4
ipa-server-trust-ad-debuginfo-4.10.1-12.el9_2.6.x86_64.rpm SHA-256: 23dbb610daf20f189b17fa5b0f2809b26903edfc7ae6dc8e66b9aacac330be8d
python3-ipaclient-4.10.1-12.el9_2.6.noarch.rpm SHA-256: f3e84c8c6144969d8054b8ff3816f95c4e774f04eee2a40d93abe618ea5b3baa
python3-ipalib-4.10.1-12.el9_2.6.noarch.rpm SHA-256: 60fde62c4e4611b4a5f045bcb4e41157c6a5dee78c447b47401d776f30a3c820
python3-ipaserver-4.10.1-12.el9_2.6.noarch.rpm SHA-256: 893a74b135bedb4ebc506ec8bbc284d5c16a904a4e6ac48d3ae0c7e617ebb17e

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.2

SRPM
ipa-4.10.1-12.el9_2.6.src.rpm SHA-256: 61526e4e09e03b0b550cd11559a21653ec0ef4aa3e419986ea2adc1e19df9193
ppc64le
ipa-client-4.10.1-12.el9_2.6.ppc64le.rpm SHA-256: 4ff0ad319ece8e3b10fca1e4617344e6fd72ecaffc9fb5cec23512dddafa9d92
ipa-client-common-4.10.1-12.el9_2.6.noarch.rpm SHA-256: 1f92bb5387334ab19b1a3eff9b2c18fd05de2adc2d537d63866f132182b05bfc
ipa-client-debuginfo-4.10.1-12.el9_2.6.ppc64le.rpm SHA-256: 91eb0ab6719eda9f3fc0d6b9f3531f016066c18ae43da17336a49f7c04f50c7b
ipa-client-epn-4.10.1-12.el9_2.6.ppc64le.rpm SHA-256: de153e815197218a41d9169451a696758140c6912aca0ac81e1a80367c2aaac0
ipa-client-samba-4.10.1-12.el9_2.6.ppc64le.rpm SHA-256: ce29cbf71c927802cf20efed42d152287079d1e1e00c5d08fbb38050d4039e08
ipa-common-4.10.1-12.el9_2.6.noarch.rpm SHA-256: 916a97e67e005c19c6e2b7099a18da2a98048b770c6f44607fba02c0865411fa
ipa-debuginfo-4.10.1-12.el9_2.6.ppc64le.rpm SHA-256: 96026123a98f0716e3c5241d11f3052907f480d1979a9d57f08c7fac5941b4fa
ipa-debugsource-4.10.1-12.el9_2.6.ppc64le.rpm SHA-256: 6396407e0a674e9793d86aa7e240b16651dc44f473a345533da6e6f47492607b
ipa-selinux-4.10.1-12.el9_2.6.noarch.rpm SHA-256: c6ebc27774ad0ad9205ec609d525c4587414ae73dd4a8184ab892b9e5073e6f1
ipa-server-4.10.1-12.el9_2.6.ppc64le.rpm SHA-256: 53a2fceecec7c6f3bcdda9f26f6c4aef9d19d053187a5cefae357ed96aa8e755
ipa-server-common-4.10.1-12.el9_2.6.noarch.rpm SHA-256: ed74884bcd3ae74cf89b6e66dfa60068be08786efdfdf6e5735ed16820514475
ipa-server-debuginfo-4.10.1-12.el9_2.6.ppc64le.rpm SHA-256: 4a0dddf0f92b7fa32f69fb527896cd3431d32ef66aa3e2801daab4ce8ce2dcc1
ipa-server-dns-4.10.1-12.el9_2.6.noarch.rpm SHA-256: 355d58c264afd63a3468f03f56eed071a0abff7e46fbeb8e76de119055c453d6
ipa-server-trust-ad-4.10.1-12.el9_2.6.ppc64le.rpm SHA-256: 45e96a358bef1061900a3dc701261533d2ec7f5c8c5418cb77579dbeed60db12
ipa-server-trust-ad-debuginfo-4.10.1-12.el9_2.6.ppc64le.rpm SHA-256: bff9f37644a32ea66babeb43914d50ddd9d45b9374978a41cbbdc0126661b7a3
python3-ipaclient-4.10.1-12.el9_2.6.noarch.rpm SHA-256: f3e84c8c6144969d8054b8ff3816f95c4e774f04eee2a40d93abe618ea5b3baa
python3-ipalib-4.10.1-12.el9_2.6.noarch.rpm SHA-256: 60fde62c4e4611b4a5f045bcb4e41157c6a5dee78c447b47401d776f30a3c820
python3-ipaserver-4.10.1-12.el9_2.6.noarch.rpm SHA-256: 893a74b135bedb4ebc506ec8bbc284d5c16a904a4e6ac48d3ae0c7e617ebb17e

Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.2

SRPM
ipa-4.10.1-12.el9_2.6.src.rpm SHA-256: 61526e4e09e03b0b550cd11559a21653ec0ef4aa3e419986ea2adc1e19df9193
x86_64
ipa-client-4.10.1-12.el9_2.6.x86_64.rpm SHA-256: 318f9f27f49a280f9e5584c2443bf9f8be19bee7d4e7c4671ec71cf4a97531e6
ipa-client-common-4.10.1-12.el9_2.6.noarch.rpm SHA-256: 1f92bb5387334ab19b1a3eff9b2c18fd05de2adc2d537d63866f132182b05bfc
ipa-client-debuginfo-4.10.1-12.el9_2.6.x86_64.rpm SHA-256: 5f994d3e82533c16d3ba5da380fffca2d27809b7d2c90a1237d6ae56be3c86f8
ipa-client-epn-4.10.1-12.el9_2.6.x86_64.rpm SHA-256: a9257ca8401e3c7ff9c73c244705278cabb2c6ba33974ae7579358b52e03bc04
ipa-client-samba-4.10.1-12.el9_2.6.x86_64.rpm SHA-256: 78dbb473359cae4f21fc30e0782df36756377e0c355ffc2f704387fb9ff3c968
ipa-common-4.10.1-12.el9_2.6.noarch.rpm SHA-256: 916a97e67e005c19c6e2b7099a18da2a98048b770c6f44607fba02c0865411fa
ipa-debuginfo-4.10.1-12.el9_2.6.x86_64.rpm SHA-256: ac5c72db3ab67f8f2cf2d0eb4aa80e50238ae3ebefc95caae51e31ba2f777b7c
ipa-debugsource-4.10.1-12.el9_2.6.x86_64.rpm SHA-256: c82f982e4481422a535b6fc8fd23ffb918a205411edd9843d28c4debe9c8a67d
ipa-selinux-4.10.1-12.el9_2.6.noarch.rpm SHA-256: c6ebc27774ad0ad9205ec609d525c4587414ae73dd4a8184ab892b9e5073e6f1
ipa-server-4.10.1-12.el9_2.6.x86_64.rpm SHA-256: 74a05f7519af05d0e9f6e1f238e9fb60425d657a729e2c2ec747822204ad7bd9
ipa-server-common-4.10.1-12.el9_2.6.noarch.rpm SHA-256: ed74884bcd3ae74cf89b6e66dfa60068be08786efdfdf6e5735ed16820514475
ipa-server-debuginfo-4.10.1-12.el9_2.6.x86_64.rpm SHA-256: 419ac6a02984bd7bcb1082c3a5fe0375a727de047caaec4e94423b084a11cd9d
ipa-server-dns-4.10.1-12.el9_2.6.noarch.rpm SHA-256: 355d58c264afd63a3468f03f56eed071a0abff7e46fbeb8e76de119055c453d6
ipa-server-trust-ad-4.10.1-12.el9_2.6.x86_64.rpm SHA-256: ebd94403554c1ec6f77fe36f5f3dfcd0fe62e7aee5a89c8878315d2de2e798e4
ipa-server-trust-ad-debuginfo-4.10.1-12.el9_2.6.x86_64.rpm SHA-256: 23dbb610daf20f189b17fa5b0f2809b26903edfc7ae6dc8e66b9aacac330be8d
python3-ipaclient-4.10.1-12.el9_2.6.noarch.rpm SHA-256: f3e84c8c6144969d8054b8ff3816f95c4e774f04eee2a40d93abe618ea5b3baa
python3-ipalib-4.10.1-12.el9_2.6.noarch.rpm SHA-256: 60fde62c4e4611b4a5f045bcb4e41157c6a5dee78c447b47401d776f30a3c820
python3-ipaserver-4.10.1-12.el9_2.6.noarch.rpm SHA-256: 893a74b135bedb4ebc506ec8bbc284d5c16a904a4e6ac48d3ae0c7e617ebb17e

Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.2

SRPM
ipa-4.10.1-12.el9_2.6.src.rpm SHA-256: 61526e4e09e03b0b550cd11559a21653ec0ef4aa3e419986ea2adc1e19df9193
aarch64
ipa-client-4.10.1-12.el9_2.6.aarch64.rpm SHA-256: a77bff0c72c17da711985db21f079910033bd5e53f68c753c9fbe4c326526989
ipa-client-common-4.10.1-12.el9_2.6.noarch.rpm SHA-256: 1f92bb5387334ab19b1a3eff9b2c18fd05de2adc2d537d63866f132182b05bfc
ipa-client-debuginfo-4.10.1-12.el9_2.6.aarch64.rpm SHA-256: e737f07f45cbd60abe630dcdce30900c1c536b01ff7d8b3c1d3df06a8bb81655
ipa-client-epn-4.10.1-12.el9_2.6.aarch64.rpm SHA-256: 392b1be04a6262cd750ab76b5cc0a0c7646699f2e1eaf6c3bd4b9742a3017ec3
ipa-client-samba-4.10.1-12.el9_2.6.aarch64.rpm SHA-256: 7831c38b7f5e4dd33fa4556db0f4f773e5757d7238a1579b831167fee3c1f09c
ipa-common-4.10.1-12.el9_2.6.noarch.rpm SHA-256: 916a97e67e005c19c6e2b7099a18da2a98048b770c6f44607fba02c0865411fa
ipa-debuginfo-4.10.1-12.el9_2.6.aarch64.rpm SHA-256: 81d0b09721db6c298e8420139a253a17b92b6b16b9da3928de58eba3d04869c9
ipa-debugsource-4.10.1-12.el9_2.6.aarch64.rpm SHA-256: 6fb5395d6b5f1b93d096e3f5f7040417ccda352001a227b9e79ac560e2dec05b
ipa-selinux-4.10.1-12.el9_2.6.noarch.rpm SHA-256: c6ebc27774ad0ad9205ec609d525c4587414ae73dd4a8184ab892b9e5073e6f1
ipa-server-4.10.1-12.el9_2.6.aarch64.rpm SHA-256: 68132dbd610e1ee4f9ceb70a0a16dde8785474f89a60e87d5ff2ae0ba9699b49
ipa-server-common-4.10.1-12.el9_2.6.noarch.rpm SHA-256: ed74884bcd3ae74cf89b6e66dfa60068be08786efdfdf6e5735ed16820514475
ipa-server-debuginfo-4.10.1-12.el9_2.6.aarch64.rpm SHA-256: 87774e7c6aff8f200073bd94093f745589c5d86b5871138f81ffa53ee3e931bb
ipa-server-dns-4.10.1-12.el9_2.6.noarch.rpm SHA-256: 355d58c264afd63a3468f03f56eed071a0abff7e46fbeb8e76de119055c453d6
ipa-server-trust-ad-4.10.1-12.el9_2.6.aarch64.rpm SHA-256: 2ef3fc50d044fc9992fcdb2d9ee7a4cb54619cfe49f4e1eafc9a08f51d1a9c14
ipa-server-trust-ad-debuginfo-4.10.1-12.el9_2.6.aarch64.rpm SHA-256: 40a2a8bc2001a870dcd38344d18b43efbe7c261057d4a6eb7b82bb869ab0e750
python3-ipaclient-4.10.1-12.el9_2.6.noarch.rpm SHA-256: f3e84c8c6144969d8054b8ff3816f95c4e774f04eee2a40d93abe618ea5b3baa
python3-ipalib-4.10.1-12.el9_2.6.noarch.rpm SHA-256: 60fde62c4e4611b4a5f045bcb4e41157c6a5dee78c447b47401d776f30a3c820
python3-ipaserver-4.10.1-12.el9_2.6.noarch.rpm SHA-256: 893a74b135bedb4ebc506ec8bbc284d5c16a904a4e6ac48d3ae0c7e617ebb17e

Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.2

SRPM
ipa-4.10.1-12.el9_2.6.src.rpm SHA-256: 61526e4e09e03b0b550cd11559a21653ec0ef4aa3e419986ea2adc1e19df9193
s390x
ipa-client-4.10.1-12.el9_2.6.s390x.rpm SHA-256: db269edfe462664ca40b26e1b9dd360f43582008d0f14af7e7f3762b16433cb6
ipa-client-common-4.10.1-12.el9_2.6.noarch.rpm SHA-256: 1f92bb5387334ab19b1a3eff9b2c18fd05de2adc2d537d63866f132182b05bfc
ipa-client-debuginfo-4.10.1-12.el9_2.6.s390x.rpm SHA-256: 8c56142ea0ec2d4058f00c2f37a2b0ec1e465e7ec51326208ff7ec6720522e48
ipa-client-epn-4.10.1-12.el9_2.6.s390x.rpm SHA-256: 07bb01210f9751588d515ef34232be89708fc271bcd86e041e530a94fd4cc8a8
ipa-client-samba-4.10.1-12.el9_2.6.s390x.rpm SHA-256: ca7d0a72d6b3852c4ad37f645281ffb6f54716ccfe4429fa87f2f8894f81cbf0
ipa-common-4.10.1-12.el9_2.6.noarch.rpm SHA-256: 916a97e67e005c19c6e2b7099a18da2a98048b770c6f44607fba02c0865411fa
ipa-debuginfo-4.10.1-12.el9_2.6.s390x.rpm SHA-256: b296a90312273cb84baa3ec0116f00d539828d5d4f1349b338be80f4eb038bd8
ipa-debugsource-4.10.1-12.el9_2.6.s390x.rpm SHA-256: 6577f9b469010010bb37dc7f91430876fb2784833557aeb08d5639ed1a00c6c4
ipa-selinux-4.10.1-12.el9_2.6.noarch.rpm SHA-256: c6ebc27774ad0ad9205ec609d525c4587414ae73dd4a8184ab892b9e5073e6f1
ipa-server-4.10.1-12.el9_2.6.s390x.rpm SHA-256: e475477f7069b2e61d5e849880b24f327458ccc6eeb9ebb3d5047ba3505d8922
ipa-server-common-4.10.1-12.el9_2.6.noarch.rpm SHA-256: ed74884bcd3ae74cf89b6e66dfa60068be08786efdfdf6e5735ed16820514475
ipa-server-debuginfo-4.10.1-12.el9_2.6.s390x.rpm SHA-256: 195af96724832d444669a05c27b6de193d627fc4421cc1f7844a86e972dcf3f1
ipa-server-dns-4.10.1-12.el9_2.6.noarch.rpm SHA-256: 355d58c264afd63a3468f03f56eed071a0abff7e46fbeb8e76de119055c453d6
ipa-server-trust-ad-4.10.1-12.el9_2.6.s390x.rpm SHA-256: 9ac2325da9a641dbc6e9f0843dfb4a6b4f3e7c2c091bc6790a09059f0c61e0db
ipa-server-trust-ad-debuginfo-4.10.1-12.el9_2.6.s390x.rpm SHA-256: c333329c51a1c81a744743dd9f41f114e540765831c144d2198a9d9bdd031538
python3-ipaclient-4.10.1-12.el9_2.6.noarch.rpm SHA-256: f3e84c8c6144969d8054b8ff3816f95c4e774f04eee2a40d93abe618ea5b3baa
python3-ipalib-4.10.1-12.el9_2.6.noarch.rpm SHA-256: 60fde62c4e4611b4a5f045bcb4e41157c6a5dee78c447b47401d776f30a3c820
python3-ipaserver-4.10.1-12.el9_2.6.noarch.rpm SHA-256: 893a74b135bedb4ebc506ec8bbc284d5c16a904a4e6ac48d3ae0c7e617ebb17e

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.