affected:
- package:
    ecosystem: PyPI
    name: ipa
    purl: pkg:pypi/ipa
  ranges:
  - events:
    - introduced: '0'
    type: ECOSYSTEM
  versions:
  - 4.10.2
  - 4.12.2
  - 4.4.0.dev1
  - 4.5.0
  - 4.5.2
  - 4.5.4
  - 4.6.2
  - 4.6.3
  - 4.6.4
  - 4.6.5
  - 4.6.7
  - 4.7.0
  - 4.7.1
  - 4.7.2
  - 4.7.4
  - 4.7.5
  - 4.8.0
  - 4.8.0rc1
  - 4.8.1
  - 4.8.2
  - 4.8.3
  - 4.8.5
  - 4.8.6
  - 4.8.7
  - 4.8.9
  - 4.9.12
aliases:
- CVE-2014-7828
details: FreeIPA 4.0.x before 4.0.5 and 4.1.x before 4.1.1, when 2FA is enabled, allows
  remote attackers to bypass the password requirement of the two-factor authentication
  leveraging an enabled OTP token, which triggers an anonymous bind.
id: PYSEC-2014-104
modified: '2024-11-21T14:22:52.00819Z'
published: '2014-11-19T18:59:00Z'
references:
- type: WEB
  url: https://www.redhat.com/archives/freeipa-users/2014-November/msg00077.html
- type: WEB
  url: https://fedorahosted.org/freeipa/ticket/4690
- type: WEB
  url: https://www.redhat.com/archives/freeipa-devel/2014-November/msg00068.html
- type: REPORT
  url: https://bugzilla.redhat.com/show_bug.cgi?id=1160871
- type: WEB
  url: http://www.securityfocus.com/bid/70932
- type: WEB
  url: http://lists.fedoraproject.org/pipermail/package-announce/2014-November/143000.html
- type: ADVISORY
  url: http://www.freeipa.org/page/Releases/4.1.1
- type: WEB
  url: https://exchange.xforce.ibmcloud.com/vulnerabilities/98500
withdrawn: '2024-11-22T04:37:04Z'