Red Hat Product Errata RHSA-2025:9187 - Security Advisory
Issued:
2025-06-17
Updated:
2025-06-17

RHSA-2025:9187 - Security Advisory

Synopsis

Important: ipa security update

Type/Severity

Security Advisory: Important

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for ipa is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments.

Security Fix(es):

  • freeIPA: idm: Privilege escalation from host to domain admin in FreeIPA (CVE-2025-4404)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux Server - AUS 9.2 x86_64
  • Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.2 ppc64le
  • Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.2 x86_64
  • Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.2 aarch64
  • Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.2 s390x

Fixes

  • BZ - 2364606 - CVE-2025-4404 freeIPA: idm: Privilege escalation from host to domain admin in FreeIPA

Red Hat Enterprise Linux Server - AUS 9.2

SRPM
ipa-4.10.1-12.el9_2.4.src.rpm SHA-256: 7df7d9a2cd42a91a38c8510ac49c27166d6d69d62aa339121a5c0f980d138ca7
x86_64
ipa-client-4.10.1-12.el9_2.4.x86_64.rpm SHA-256: 72481c7c31433997bab201505eaa9189339b1ed817f7699afe46bddfccaa4733
ipa-client-common-4.10.1-12.el9_2.4.noarch.rpm SHA-256: 649e3c7a62e9fe3cc7497177c95af9a27325bf83728871d35d732687560d1d51
ipa-client-debuginfo-4.10.1-12.el9_2.4.x86_64.rpm SHA-256: 5ae321d9cf0bbcc53304d0ef3e54824964d99d0cf34f18335beb5056c748450c
ipa-client-epn-4.10.1-12.el9_2.4.x86_64.rpm SHA-256: 3c35747288d96d6967cd9ce6e0033348c7b0c2448eeb3abba69589d99ef6c56b
ipa-client-samba-4.10.1-12.el9_2.4.x86_64.rpm SHA-256: e3149ce6d9f7209ec4ae6bfd8f89c2b084ac8535c01bfbd75cb823b3690706bb
ipa-common-4.10.1-12.el9_2.4.noarch.rpm SHA-256: f4f889d48ae717689488d7c139f8a12f5d8889501249a94755c0162151d0c331
ipa-debuginfo-4.10.1-12.el9_2.4.x86_64.rpm SHA-256: 5f010dd8360b31ec419dcc290926bf296a0f07c697f04918e53c1105bb5b9b55
ipa-debugsource-4.10.1-12.el9_2.4.x86_64.rpm SHA-256: 9763bce3bd73284f2a8b76a7bd008e29f36842fa4bb904a7645cf6bd8287d518
ipa-selinux-4.10.1-12.el9_2.4.noarch.rpm SHA-256: 8757a12312e9cdda90d21682810b768ee6e1bf651cdc94ffa236923f11bda810
ipa-server-4.10.1-12.el9_2.4.x86_64.rpm SHA-256: 64a93d6729d4ee22d7b1267754620f2abfebbed6fca2bfe47f940d2fbfb4f1de
ipa-server-common-4.10.1-12.el9_2.4.noarch.rpm SHA-256: db7a76aeaa16915a6ad408cf98c12cb9a3043bc77b55b3d37b37416eb6cac043
ipa-server-debuginfo-4.10.1-12.el9_2.4.x86_64.rpm SHA-256: 0e6dd145ba86370ebd631fc9b393ba1c85a3cb4e42c7e507a8c85c4d2a858b0b
ipa-server-dns-4.10.1-12.el9_2.4.noarch.rpm SHA-256: 3926478cc550490c85329088544c40c13f4ec37da544f6b8d2bbf9e90cb70006
ipa-server-trust-ad-4.10.1-12.el9_2.4.x86_64.rpm SHA-256: 008ae635ae419e79bae62b239bac6bf2c52dd010b6653784352219f891dc6b61
ipa-server-trust-ad-debuginfo-4.10.1-12.el9_2.4.x86_64.rpm SHA-256: 68caa0f356abf5824070e03177ff0f55ae60d153887096f76c78c00dd80f3def
python3-ipaclient-4.10.1-12.el9_2.4.noarch.rpm SHA-256: d0a8b906fae849fb02024198ad924a86dbf33cc9597a1a057a72ee56771504f9
python3-ipalib-4.10.1-12.el9_2.4.noarch.rpm SHA-256: ddaaddf27feabf765a8dbc28593c0155e19a6e0119249ffe6fc2e04ebef5a058
python3-ipaserver-4.10.1-12.el9_2.4.noarch.rpm SHA-256: 465c9e91af38b1b67fc4b5fc6a831d68204ba59f33390c8411c54094cc56f608

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.2

SRPM
ipa-4.10.1-12.el9_2.4.src.rpm SHA-256: 7df7d9a2cd42a91a38c8510ac49c27166d6d69d62aa339121a5c0f980d138ca7
ppc64le
ipa-client-4.10.1-12.el9_2.4.ppc64le.rpm SHA-256: bfb075ac68e5f429293d383b2c5dab2eaaaa0dac1d87f0ff79bc7794c55fc298
ipa-client-common-4.10.1-12.el9_2.4.noarch.rpm SHA-256: 649e3c7a62e9fe3cc7497177c95af9a27325bf83728871d35d732687560d1d51
ipa-client-debuginfo-4.10.1-12.el9_2.4.ppc64le.rpm SHA-256: 8565e94ea43b14f291fa5c5623098432161343b420d798139fe38c80722dc0f1
ipa-client-epn-4.10.1-12.el9_2.4.ppc64le.rpm SHA-256: c05af610b8f34c0eb0c169169b223e4f7dddc1e755c8a31d3a9d07e3544230b4
ipa-client-samba-4.10.1-12.el9_2.4.ppc64le.rpm SHA-256: 18ef8e1364724753ceb8e58beb11de8a750ca9e583b3b2e5399a29d7cee47d94
ipa-common-4.10.1-12.el9_2.4.noarch.rpm SHA-256: f4f889d48ae717689488d7c139f8a12f5d8889501249a94755c0162151d0c331
ipa-debuginfo-4.10.1-12.el9_2.4.ppc64le.rpm SHA-256: 87ff8e7b63ae9af32cf6bbe0b2ae80a1f11f440ef53c32840f0bf5d4f02e4146
ipa-debugsource-4.10.1-12.el9_2.4.ppc64le.rpm SHA-256: 27c112ba3ad73c04f7bf4483e74691325ce67567455f286fa3f274db7024394f
ipa-selinux-4.10.1-12.el9_2.4.noarch.rpm SHA-256: 8757a12312e9cdda90d21682810b768ee6e1bf651cdc94ffa236923f11bda810
ipa-server-4.10.1-12.el9_2.4.ppc64le.rpm SHA-256: 162b990a221374e08392e53cc085e224a4be76bac917317c3c3fc7fa6992ff90
ipa-server-common-4.10.1-12.el9_2.4.noarch.rpm SHA-256: db7a76aeaa16915a6ad408cf98c12cb9a3043bc77b55b3d37b37416eb6cac043
ipa-server-debuginfo-4.10.1-12.el9_2.4.ppc64le.rpm SHA-256: 23a73bb3ac9ac5214e46fa38d4aef50135b061ac727fc7c7aeff6df1b3dc5562
ipa-server-dns-4.10.1-12.el9_2.4.noarch.rpm SHA-256: 3926478cc550490c85329088544c40c13f4ec37da544f6b8d2bbf9e90cb70006
ipa-server-trust-ad-4.10.1-12.el9_2.4.ppc64le.rpm SHA-256: 2fc6e02f3647a43ff3981e9af1ebcd6b343a5491adcbed302286e6dacdd9e5e0
ipa-server-trust-ad-debuginfo-4.10.1-12.el9_2.4.ppc64le.rpm SHA-256: cc4be84d7e1352eec5c094135388650e47397aef500a9bacb910374fcc0a6e33
python3-ipaclient-4.10.1-12.el9_2.4.noarch.rpm SHA-256: d0a8b906fae849fb02024198ad924a86dbf33cc9597a1a057a72ee56771504f9
python3-ipalib-4.10.1-12.el9_2.4.noarch.rpm SHA-256: ddaaddf27feabf765a8dbc28593c0155e19a6e0119249ffe6fc2e04ebef5a058
python3-ipaserver-4.10.1-12.el9_2.4.noarch.rpm SHA-256: 465c9e91af38b1b67fc4b5fc6a831d68204ba59f33390c8411c54094cc56f608

Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.2

SRPM
ipa-4.10.1-12.el9_2.4.src.rpm SHA-256: 7df7d9a2cd42a91a38c8510ac49c27166d6d69d62aa339121a5c0f980d138ca7
x86_64
ipa-client-4.10.1-12.el9_2.4.x86_64.rpm SHA-256: 72481c7c31433997bab201505eaa9189339b1ed817f7699afe46bddfccaa4733
ipa-client-common-4.10.1-12.el9_2.4.noarch.rpm SHA-256: 649e3c7a62e9fe3cc7497177c95af9a27325bf83728871d35d732687560d1d51
ipa-client-debuginfo-4.10.1-12.el9_2.4.x86_64.rpm SHA-256: 5ae321d9cf0bbcc53304d0ef3e54824964d99d0cf34f18335beb5056c748450c
ipa-client-epn-4.10.1-12.el9_2.4.x86_64.rpm SHA-256: 3c35747288d96d6967cd9ce6e0033348c7b0c2448eeb3abba69589d99ef6c56b
ipa-client-samba-4.10.1-12.el9_2.4.x86_64.rpm SHA-256: e3149ce6d9f7209ec4ae6bfd8f89c2b084ac8535c01bfbd75cb823b3690706bb
ipa-common-4.10.1-12.el9_2.4.noarch.rpm SHA-256: f4f889d48ae717689488d7c139f8a12f5d8889501249a94755c0162151d0c331
ipa-debuginfo-4.10.1-12.el9_2.4.x86_64.rpm SHA-256: 5f010dd8360b31ec419dcc290926bf296a0f07c697f04918e53c1105bb5b9b55
ipa-debugsource-4.10.1-12.el9_2.4.x86_64.rpm SHA-256: 9763bce3bd73284f2a8b76a7bd008e29f36842fa4bb904a7645cf6bd8287d518
ipa-selinux-4.10.1-12.el9_2.4.noarch.rpm SHA-256: 8757a12312e9cdda90d21682810b768ee6e1bf651cdc94ffa236923f11bda810
ipa-server-4.10.1-12.el9_2.4.x86_64.rpm SHA-256: 64a93d6729d4ee22d7b1267754620f2abfebbed6fca2bfe47f940d2fbfb4f1de
ipa-server-common-4.10.1-12.el9_2.4.noarch.rpm SHA-256: db7a76aeaa16915a6ad408cf98c12cb9a3043bc77b55b3d37b37416eb6cac043
ipa-server-debuginfo-4.10.1-12.el9_2.4.x86_64.rpm SHA-256: 0e6dd145ba86370ebd631fc9b393ba1c85a3cb4e42c7e507a8c85c4d2a858b0b
ipa-server-dns-4.10.1-12.el9_2.4.noarch.rpm SHA-256: 3926478cc550490c85329088544c40c13f4ec37da544f6b8d2bbf9e90cb70006
ipa-server-trust-ad-4.10.1-12.el9_2.4.x86_64.rpm SHA-256: 008ae635ae419e79bae62b239bac6bf2c52dd010b6653784352219f891dc6b61
ipa-server-trust-ad-debuginfo-4.10.1-12.el9_2.4.x86_64.rpm SHA-256: 68caa0f356abf5824070e03177ff0f55ae60d153887096f76c78c00dd80f3def
python3-ipaclient-4.10.1-12.el9_2.4.noarch.rpm SHA-256: d0a8b906fae849fb02024198ad924a86dbf33cc9597a1a057a72ee56771504f9
python3-ipalib-4.10.1-12.el9_2.4.noarch.rpm SHA-256: ddaaddf27feabf765a8dbc28593c0155e19a6e0119249ffe6fc2e04ebef5a058
python3-ipaserver-4.10.1-12.el9_2.4.noarch.rpm SHA-256: 465c9e91af38b1b67fc4b5fc6a831d68204ba59f33390c8411c54094cc56f608

Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.2

SRPM
ipa-4.10.1-12.el9_2.4.src.rpm SHA-256: 7df7d9a2cd42a91a38c8510ac49c27166d6d69d62aa339121a5c0f980d138ca7
aarch64
ipa-client-4.10.1-12.el9_2.4.aarch64.rpm SHA-256: c1c4567730c3910de4bbcc4a5cae97439d8f06c01488e57ecdc084651d4fd718
ipa-client-common-4.10.1-12.el9_2.4.noarch.rpm SHA-256: 649e3c7a62e9fe3cc7497177c95af9a27325bf83728871d35d732687560d1d51
ipa-client-debuginfo-4.10.1-12.el9_2.4.aarch64.rpm SHA-256: d5803466f99cdde4ad96620d1e4c5bcf1541eeb3142cba1269ee1bde2432f9b8
ipa-client-epn-4.10.1-12.el9_2.4.aarch64.rpm SHA-256: 41b5396d9d352b3018de953dcf843d0eccf753de0e845ab52e2596b69870f0c7
ipa-client-samba-4.10.1-12.el9_2.4.aarch64.rpm SHA-256: bed9039c702c16957b8d84aa4ff429219a7dc3917a489ec22e1a6abfc4cbe953
ipa-common-4.10.1-12.el9_2.4.noarch.rpm SHA-256: f4f889d48ae717689488d7c139f8a12f5d8889501249a94755c0162151d0c331
ipa-debuginfo-4.10.1-12.el9_2.4.aarch64.rpm SHA-256: bffc5a15cee3b220dc8c943fa12b375df976a81785cbde3174ed28a4fca066e5
ipa-debugsource-4.10.1-12.el9_2.4.aarch64.rpm SHA-256: af000d14252657fb74b3242283aef69d5ca0dd09d256634e752c9833ce9291ed
ipa-selinux-4.10.1-12.el9_2.4.noarch.rpm SHA-256: 8757a12312e9cdda90d21682810b768ee6e1bf651cdc94ffa236923f11bda810
ipa-server-4.10.1-12.el9_2.4.aarch64.rpm SHA-256: d3ab5e82a6799bff4f9e17c6b1aac1510ed3b3374b65083d9309cd0e864ac566
ipa-server-common-4.10.1-12.el9_2.4.noarch.rpm SHA-256: db7a76aeaa16915a6ad408cf98c12cb9a3043bc77b55b3d37b37416eb6cac043
ipa-server-debuginfo-4.10.1-12.el9_2.4.aarch64.rpm SHA-256: 61f2ef495765e149f1ad9f7b6315031e9921cc413b420abd8410925803b7d61c
ipa-server-dns-4.10.1-12.el9_2.4.noarch.rpm SHA-256: 3926478cc550490c85329088544c40c13f4ec37da544f6b8d2bbf9e90cb70006
ipa-server-trust-ad-4.10.1-12.el9_2.4.aarch64.rpm SHA-256: a10aed06add8e5361a42f94c1680325004420bc6704b688742241be22421f72e
ipa-server-trust-ad-debuginfo-4.10.1-12.el9_2.4.aarch64.rpm SHA-256: 94515d351458ad52c7a19b8615eec712827f7199685a767ea721815da95bc5e6
python3-ipaclient-4.10.1-12.el9_2.4.noarch.rpm SHA-256: d0a8b906fae849fb02024198ad924a86dbf33cc9597a1a057a72ee56771504f9
python3-ipalib-4.10.1-12.el9_2.4.noarch.rpm SHA-256: ddaaddf27feabf765a8dbc28593c0155e19a6e0119249ffe6fc2e04ebef5a058
python3-ipaserver-4.10.1-12.el9_2.4.noarch.rpm SHA-256: 465c9e91af38b1b67fc4b5fc6a831d68204ba59f33390c8411c54094cc56f608

Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.2

SRPM
ipa-4.10.1-12.el9_2.4.src.rpm SHA-256: 7df7d9a2cd42a91a38c8510ac49c27166d6d69d62aa339121a5c0f980d138ca7
s390x
ipa-client-4.10.1-12.el9_2.4.s390x.rpm SHA-256: 863cc72f3a599245adac4d7694582380a3af7100b748973d4e258535aa856a7b
ipa-client-common-4.10.1-12.el9_2.4.noarch.rpm SHA-256: 649e3c7a62e9fe3cc7497177c95af9a27325bf83728871d35d732687560d1d51
ipa-client-debuginfo-4.10.1-12.el9_2.4.s390x.rpm SHA-256: ebf4a978eb9f92c959d6167b81048c0d326b7a1fdd36bc724f815fe43e88f51c
ipa-client-epn-4.10.1-12.el9_2.4.s390x.rpm SHA-256: 64b38b792fcf32cc70ce9916d3a92f7ab4a1c7c7d8069a1ad94a6a430fb4a682
ipa-client-samba-4.10.1-12.el9_2.4.s390x.rpm SHA-256: 1fad4029475ee2b0efaafbf90915a251a6d6816ca07cebc6cba03d31617b7f96
ipa-common-4.10.1-12.el9_2.4.noarch.rpm SHA-256: f4f889d48ae717689488d7c139f8a12f5d8889501249a94755c0162151d0c331
ipa-debuginfo-4.10.1-12.el9_2.4.s390x.rpm SHA-256: e45e5c4ac780d70da0a52112c917a07dec4a25c4a91bf9fa1da02d616aff70be
ipa-debugsource-4.10.1-12.el9_2.4.s390x.rpm SHA-256: f30c299775c13d65987fcec53aa93ce94a47f306a2e604cffb50c004a777bdc8
ipa-selinux-4.10.1-12.el9_2.4.noarch.rpm SHA-256: 8757a12312e9cdda90d21682810b768ee6e1bf651cdc94ffa236923f11bda810
ipa-server-4.10.1-12.el9_2.4.s390x.rpm SHA-256: 315c551dc617fad952e3ef68398487573b49ae2dd721f563b2fc64eea05caf8c
ipa-server-common-4.10.1-12.el9_2.4.noarch.rpm SHA-256: db7a76aeaa16915a6ad408cf98c12cb9a3043bc77b55b3d37b37416eb6cac043
ipa-server-debuginfo-4.10.1-12.el9_2.4.s390x.rpm SHA-256: 5de96749cf1dd642b06f95074e557f4a31e4f754ff73add5b1f3d2624d365177
ipa-server-dns-4.10.1-12.el9_2.4.noarch.rpm SHA-256: 3926478cc550490c85329088544c40c13f4ec37da544f6b8d2bbf9e90cb70006
ipa-server-trust-ad-4.10.1-12.el9_2.4.s390x.rpm SHA-256: 10e4957e25f263dcacc94eeecb593f6f605c7831d5058b049a2a276b0a94f291
ipa-server-trust-ad-debuginfo-4.10.1-12.el9_2.4.s390x.rpm SHA-256: 5245ea7ac81d9d8a685d708790691efea9109ef315a0e2a0a385dd0fb59a5eea
python3-ipaclient-4.10.1-12.el9_2.4.noarch.rpm SHA-256: d0a8b906fae849fb02024198ad924a86dbf33cc9597a1a057a72ee56771504f9
python3-ipalib-4.10.1-12.el9_2.4.noarch.rpm SHA-256: ddaaddf27feabf765a8dbc28593c0155e19a6e0119249ffe6fc2e04ebef5a058
python3-ipaserver-4.10.1-12.el9_2.4.noarch.rpm SHA-256: 465c9e91af38b1b67fc4b5fc6a831d68204ba59f33390c8411c54094cc56f608

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.