A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the /ipa/migration/migration.py endpoint. This can force the migration handler to read attacker-controlled request bodies fully into memory, leading to increased memory usage, slower request handling, and potential service disruption or denial of service.
If the /ipa/migration endpoint is not required, it can be disabled by commenting out or removing the Alias /ipa/migration and its corresponding <Directory> block in the Apache configuration file (e.g., /etc/httpd/conf.d/ipa.conf).
Alternatively, to limit the size of request bodies processed by the /ipa/migration endpoint, add the LimitRequestBody directive within the <Directory "/usr/share/ipa/migration"> block in your Apache configuration, setting a conservative limit such as 1 MiB (1048576 bytes):
apache
<Directory "/usr/share/ipa/migration">
LimitRequestBody 1048576
# ... other directives ...
</Directory>
After modifying the Apache configuration, the httpd service must be reloaded or restarted for the changes to take effect. This may temporarily interrupt service.