CVE-2020-1722: 
NixOS vulnerability analysis and mitigation

A flaw was found in all IPA (Identity, Policy, and Audit) versions 4.x.x through 4.8.0. When sending a very long password (>= 1,000,000 characters) to the server, the password hashing process could exhaust memory and CPU leading to a denial of service and the website becoming unresponsive. The vulnerability was discovered in 2019 and assigned CVE-2020-1722 (NVD, RedHat).

The vulnerability is classified as a resource consumption issue (CWE-400) with a CVSS v3.1 Base Score of 5.3 (Medium). The attack vector is network-based (AV:N) with high attack complexity (AC:H), requiring no privileges (PR:N) but user interaction (UI:R). The scope is unchanged (S:U) with no impact on confidentiality (C:N) or integrity (I:N), but high impact on availability (A:H) (NVD).

The primary impact of this vulnerability is on system availability. When exploited, it can cause the IPA server to become unresponsive due to memory and CPU exhaustion during the password hashing process. The highest threat from this vulnerability is to system availability, with no direct impact on confidentiality or integrity (RedHat).

The vulnerability requires sending a very long password (1,000,000 characters or more) to the IPA server. While the attack complexity is considered high, it can be executed remotely and requires no special privileges, though user interaction is needed (NVD).

The vulnerability has been fixed in subsequent releases of the IPA software. Red Hat has addressed this issue in Red Hat Enterprise Linux 7 through RHSA-2020:3936 and in Red Hat Enterprise Linux 8 through RHSA-2020:4670. Debian has also fixed this in bookworm version 4.9.11-1 and in sid/trixie version 4.12.2-3 (Debian Tracker).

The FreeIPA team agreed with Red Hat Security Response Team's assessment that this is a low severity, low priority issue. The vulnerability was discovered and reported by Pritam Singh from Red Hat (RedHat Bugzilla).