Two vulnerabilities in Red Hat IdM's freeipa component are fixed in an update for RHEL 9.2. CVE-2024-2698 involves delegation rules that permit a proxy service to impersonate any user to access other services, violating access control. CVE-2024-3183 allows a user to retrieve password hashes for all domain users, facilitating offline brute force attacks. The update addresses these issues by correcting delegation logic and restricting access to password hashes. The advisory covers multiple RHEL 9.2 variants and related packages.

Successful exploitation of CVE-2024-2698 could allow unauthorized proxy services to impersonate users and access target services, potentially leading to unauthorized access. CVE-2024-3183 could enable an attacker to obtain password hashes of all domain users, increasing the risk of credential compromise through offline brute force attacks. Both vulnerabilities undermine the security of centralized authentication and identity management in affected Red Hat Enterprise Linux 9.2 systems.

An official security update is available for Red Hat Enterprise Linux 9.2 and related packages that addresses these vulnerabilities. Users should apply the update RHSA-2024:3757 after ensuring all prior relevant errata are applied. The vendor advisory provides detailed instructions for applying the update. No alternative mitigations are indicated; applying the official patch is the recommended remediation.