It was found that IPA fails to invalidate the session after changing the password. In this scenario, changing the password does not destroy other sessions connected with old passwords.
Red Hat Product Security does not consider this as a security flaw. Password changes aren't expected to invalidate existing sessions. Though this is how Kerberos behaves: incrementing kvno will not invalidate any existing service tickets. This is not a concern because the lifetime on service tickets should be set appropriately (initially only a global, now also more finely configurable with the kdcpolicy plugin). This belief is reinforced by our use of mod_session: existing sessions there aren't terminated, but instead wait for expiration.
Acknowledgments: Name: Pritam Singh (Red Hat)
According to https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1703 the CVE has been withdrawn and REJECTED. Can you remove the Alias to the CVE here then as well?
In reply to comment #10: > According to > https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1703 > the CVE has been withdrawn and REJECTED. > > Can you remove the Alias to the CVE here then as well? Thank you for notifying. Setting the need info on analyst that worked on this. Regards Yogendra.
In reply to comment #10: > According to > https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1703 > the CVE has been withdrawn and REJECTED. > > Can you remove the Alias to the CVE here then as well? done, thanks for informing!