freeipa

Clone
Source Code
GIT

#4690 When OTP is used the password is not required
Closed: Fixed None Opened 9 years ago by ctria.

Closed: Fixed
Reopen Issue

When a user is configured to use OTP the expected provided password from the user is the combination of his password and the OTP tokencode.

It looks like it is possible to login by providing only the OTP tokencode.

CVE-2014-7828 is assigned.

Linked to Bugzilla bug: https://bugzilla.redhat.com/show_bug.cgi?id=1160877 (Red Hat Enterprise Linux 7)

master:

  • 79df668 Ensure that a password exists after OTP validation

ipa-4-1:

  • a601daa Ensure that a password exists after OTP validation

ipa-4-0:

  • 013e2ea Ensure that a password exists after OTP validation

This was fixed also in 4.0.5, fixing milestone.

Metadata Update from @ctria:
- Issue assigned to npmccallum
- Issue set to the milestone: FreeIPA 4.0.5
7 years ago

Log in to comment on this ticket.

Metadata
None
None
None
normal
None
None
None
None
defect
None
None
OTP
None
1
None
None
abbra
None
https://bugzilla.redhat.com/show_bug.cgi?id=1160877
None
None
None
Powered by Pagure 5.14.1
Documentation • File an Issue • About • SSH Hostkey/Fingerprint
© Red Hat, Inc. and others.