The default configuration of Red Hat Enterprise IPA 1.0.0 and FreeIPA before 1.1.1 places ldap:///anyone on the read ACL for the krbMKey attribute, which allows remote attackers to obtain the Kerberos master key via an anonymous LDAP query.
| Software | From | Fixed in |
|---|---|---|
| redhat / freeipa | - | 1.1.0.x |
| redhat / freeipa | 0.99 | 0.99.x |
| redhat / freeipa | 1.0.0 | 1.0.0.x |
| redhat / enterprise_ipa | 1.0.0 | 1.0.0.x |