Bug 1889343 - CVE-2020-10747 Clarification that roles are not meant for privilege escalation
Summary: CVE-2020-10747 Clarification that roles are not meant for privilege escalation
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: doc-Linux_Domain_Identity_Management_Guide
Version: 7.9
Hardware: Unspecified
OS: Unspecified
medium
unspecified
Target Milestone: rc
: ---
Assignee: Florian Delehaye
QA Contact: ipa-qe
Florian Delehaye
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2020-10-19 12:32 UTC by Florian Delehaye
Modified: 2020-10-19 13:51 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2020-10-19 13:51:35 UTC
Target Upstream Version:


Attachments (Terms of Use)

Description Florian Delehaye 2020-10-19 12:32:54 UTC
Document URL: 
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/linux_domain_identity_authentication_and_policy_guide/defining-roles

Section Number and Name: 
10.4. Defining Role-Based Access Controls

Describe the issue: 
We recently had a CVE-2020-10747 that was retracted. However, as a part
of the analysis for that retraction we identified that documentation is
not clear about the state of privileges in FreeIPA.
Ideally, we need a 'Note'
in https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/linux_domain_identity_authentication_and_policy_guide/defining-roles
be modified to very clearly state what Simo proposed.

Suggestions for improvement: 
"Roles are used to classify permitted actions but are not used as a tool to
implement privilege separation or to protect from privilege escalation"


Note You need to log in before you can comment on or make changes to this bug.