Two security vulnerabilities in Red Hat Identity Management's freeipa component have been identified and fixed. CVE-2024-2698 involves delegation rules that permit a proxy service to impersonate any user to access other services, representing an authorization bypass (CWE-863). CVE-2024-3183 allows a user to retrieve password hashes of all domain users, enabling offline brute force attacks (CWE-916). Red Hat has issued an important security advisory (RHSA-2024:3754) with updates for Red Hat Enterprise Linux 9 and its variants to remediate these issues.

Successful exploitation of CVE-2024-2698 could allow a proxy service to impersonate any user, potentially leading to unauthorized access to target services. CVE-2024-3183 could enable an attacker to obtain password hashes of all domain users and perform offline brute force attacks, increasing the risk of credential compromise. Both vulnerabilities pose significant risks to authentication and authorization integrity within affected Red Hat IdM environments.

Red Hat has released security updates for Red Hat Enterprise Linux 9 and related variants to address these vulnerabilities. Users should apply the updates as detailed in Red Hat advisory RHSA-2024:3754 and the referenced article https://access.redhat.com/articles/11258. Patch status is confirmed as fixed by Red Hat. No additional mitigation steps are specified beyond applying the official update.