CVE-2024-3183 is a high severity (CVSS 8.1) weakness in FreeIPA. A compromised principal can obtain service tickets for other principals and brute force their passwords offline. Red Hat published errata RHSA-2024:3754 through 3759. Apply the one that matches your RHEL release and check your package version.
What's affected
FreeIPA as packaged in Red Hat Enterprise Linux. The NVD record lists RHEL 7.0, 8.0 and the 8.2 AUS stream among affected platforms, and the Red Hat errata RHSA-2024:3754 to RHSA-2024:3759 cover several RHEL streams, including 9. The errata page we reviewed groups the fix with CVE-2024-2698 and describes this one as a user obtaining a hash of the passwords of all domain users to run an offline brute force.
Fixed package versions differ by RHEL release and stream. We did not extract a single version number, so check the advisory for your stream rather than assuming one. The record describes the mechanism: the ticket inside a TGS request is encrypted with the target principal key, which for users derives from a public salt and the password, so tickets taken offline can be tested against guesses.
The record does not name an upstream FreeIPA fixed version, so rely on your distribution advisory.
The weakness class: CWE-916, use of a password hash with insufficient computational effort. The NVD record scores it 8.1 (high) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. CISA Known Exploited Vulnerabilities status in the record: not listed.
Source note: NVD scores this 8.1 (High). The Red Hat errata page we reviewed describes the update as Important in its own classification scheme, and the fixed package versions depend on the RHEL stream. Both are published, so use the errata for your stream.
How to check if you're exposed
On RHEL and compatible systems, list the installed FreeIPA packages and compare them with the fixed versions in your errata:
rpm -q ipa-server ipa-client freeipa-server
dnf updateinfo info --cve CVE-2024-3183
The second command reads the advisory metadata your enabled repositories provide. If it returns nothing, your system may not use Red Hat repositories, or the fix may already be installed. Compare against the RHSA for your stream either way.
What to do now
- Identify the RHSA for your RHEL release among RHSA-2024:3754 to 3759 and read its fixed package versions.
- Apply the update on IPA servers first, then clients, following your change process.
- Review password strength for privileged principals. Offline guessing succeeds against weak passwords, whatever the patch status.
- Monitor for unusual bulk ticket requests from a single principal.
Why it matters
The weakness is CWE-916, use of a password hash with insufficient computational effort. The attacker needs a compromised principal first, which is why the attack complexity is rated high, but once they have one the offline step is unthrottled and invisible to the server.
Directory services concentrate trust. A flaw that turns one stolen account into a path to many others is exactly the lateral movement problem identity teams worry about. Patching helps, and so do long random passwords for service principals.
Quick check
Does patching remove the need for strong passwords?
No. The flaw lets a compromised account gather material for offline guessing. Long random passwords for privileged and service principals make that guessing impractical, and they are worth having whether or not the system is patched.
Sources
- Red Hat errata RHSA-2024:3754
- References listed in the NVD record: RHSA-2024:3755 to RHSA-2024:3759 on access.redhat.com (not individually reviewed)
- Safeguard Gold entry for CVE-2024-3183
- Free in-browser dependency scan
Last reviewed: 19 October 2026.
