Fedora 34: freeipa 2021-1d77047c61 | LinuxSecurity.com

Advisories

--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2021-1d77047c61
2021-12-01 01:12:49.872644
--------------------------------------------------------------------------------

Name        : freeipa
Product     : Fedora 34
Version     : 4.9.6
Release     : 4.fc34
URL         : https://www.freeipa.org/
Summary     : The Identity, Policy and Audit system
Description :
IPA is an integrated solution to provide centrally managed Identity (users,
hosts, services), Authentication (SSO, 2FA), and Authorization
(host access control, SELinux user roles, services). The solution provides
features for further integration with Linux based clients (SUDO, automount)
and integration with Active Directory based infrastructures (Trusts).

--------------------------------------------------------------------------------
Update Information:

Update to latest samba and libldb release (addressing various CVEs) and rebuild
freeipa
--------------------------------------------------------------------------------
ChangeLog:

* Thu Nov 11 2021 Alexander Bokovoy  - 4.9.6-4
- Hardening for CVE-2020-25717 part 2
- Handle S4U for users from trusted domains
* Wed Nov 10 2021 Alexander Bokovoy  - 4.9.6-3
- Hardening for CVE-2020-25717
- Generate SIDs for IPA users and groups by default
- Verify MS-PAC consistency when it is generated or validated
- Rebuild against samba-4.14.10
- Resolves: rhbz#2021720
- Synchronize with RHEL 8.5 patches for FreeIPA 4.9.6
--------------------------------------------------------------------------------
References:

  [ 1 ] Bug #2019660 - CVE-2016-2124 samba: SMB1 client connections can be downgraded to plaintext authentication
        https://bugzilla.redhat.com/show_bug.cgi?id=2019660
  [ 2 ] Bug #2019666 - CVE-2021-23192 samba: Subsequent DCE/RPC fragment injection vulnerability
        https://bugzilla.redhat.com/show_bug.cgi?id=2019666
  [ 3 ] Bug #2019672 - CVE-2020-25717 samba: A user in an AD Domain could become root on domain members
        https://bugzilla.redhat.com/show_bug.cgi?id=2019672
  [ 4 ] Bug #2019726 - CVE-2020-25718 samba: Samba AD DC did not correctly sandbox Kerberos tickets issues by an RODC
        https://bugzilla.redhat.com/show_bug.cgi?id=2019726
  [ 5 ] Bug #2019732 - CVE-2020-25719 samba: Samba AD DC did not always rely on the SID and PAC in Kerberos tickets
        https://bugzilla.redhat.com/show_bug.cgi?id=2019732
  [ 6 ] Bug #2019764 - CVE-2020-25722 samba: Samba AD DC did not do sufficient access and conformance checking of data stored
        https://bugzilla.redhat.com/show_bug.cgi?id=2019764
  [ 7 ] Bug #2021726 - CVE-2021-3738 samba: Use after free in Samba AD DC RPC server
        https://bugzilla.redhat.com/show_bug.cgi?id=2021726
  [ 8 ] Bug #2021728 - CVE-2020-25721 samba: Kerberos acceptors need easy access to stableAD identifiers (eg objectSid)
        https://bugzilla.redhat.com/show_bug.cgi?id=2021728
--------------------------------------------------------------------------------

This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2021-1d77047c61' at the command
line. For more information, refer to the dnf documentation available at
https://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label

All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
_______________________________________________
package-announce mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure

Fedora 34: freeipa 2021-1d77047c61

November 30, 2021

Summary

IPA is an integrated solution to provide centrally managed Identity (users,

hosts, services), Authentication (SSO, 2FA), and Authorization

(host access control, SELinux user roles, services). The solution provides

features for further integration with Linux based clients (SUDO, automount)

and integration with Active Directory based infrastructures (Trusts).

Update Information:

Update to latest samba and libldb release (addressing various CVEs) and rebuild freeipa

Change Log

* Thu Nov 11 2021 Alexander Bokovoy - 4.9.6-4 - Hardening for CVE-2020-25717 part 2 - Handle S4U for users from trusted domains * Wed Nov 10 2021 Alexander Bokovoy - 4.9.6-3 - Hardening for CVE-2020-25717 - Generate SIDs for IPA users and groups by default - Verify MS-PAC consistency when it is generated or validated - Rebuild against samba-4.14.10 - Resolves: rhbz#2021720 - Synchronize with RHEL 8.5 patches for FreeIPA 4.9.6

References

[ 1 ] Bug #2019660 - CVE-2016-2124 samba: SMB1 client connections can be downgraded to plaintext authentication https://bugzilla.redhat.com/show_bug.cgi?id=2019660 [ 2 ] Bug #2019666 - CVE-2021-23192 samba: Subsequent DCE/RPC fragment injection vulnerability https://bugzilla.redhat.com/show_bug.cgi?id=2019666 [ 3 ] Bug #2019672 - CVE-2020-25717 samba: A user in an AD Domain could become root on domain members https://bugzilla.redhat.com/show_bug.cgi?id=2019672 [ 4 ] Bug #2019726 - CVE-2020-25718 samba: Samba AD DC did not correctly sandbox Kerberos tickets issues by an RODC https://bugzilla.redhat.com/show_bug.cgi?id=2019726 [ 5 ] Bug #2019732 - CVE-2020-25719 samba: Samba AD DC did not always rely on the SID and PAC in Kerberos tickets https://bugzilla.redhat.com/show_bug.cgi?id=2019732 [ 6 ] Bug #2019764 - CVE-2020-25722 samba: Samba AD DC did not do sufficient access and conformance checking of data stored https://bugzilla.redhat.com/show_bug.cgi?id=2019764 [ 7 ] Bug #2021726 - CVE-2021-3738 samba: Use after free in Samba AD DC RPC server https://bugzilla.redhat.com/show_bug.cgi?id=2021726 [ 8 ] Bug #2021728 - CVE-2020-25721 samba: Kerberos acceptors need easy access to stableAD identifiers (eg objectSid) https://bugzilla.redhat.com/show_bug.cgi?id=2021728

Update Instructions

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2021-1d77047c61' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label

Severity
Name : freeipa
Product : Fedora 34
Version : 4.9.6
Release : 4.fc34
URL : https://www.freeipa.org/
Summary : The Identity, Policy and Audit system

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.