Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Loading...
Explore Latest Linux Security advisories
We found -6 articles for you...
98
security advisoryRed Hat Enterprise LinuxDoS threatRed Hat Enterprise Linux 8.1 RHSA-2021-2027-01 Important: ipa DoS Threat
An update for the idm:DL1 module is now available for Red Hat Enterprise Linux 8.1 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: ipa security update Advisory ID: RHSA-2021:2027-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2021:2027 Issue date: 2021-05-19 CVE Names: CVE-2021-3480 ==================================================================== 1. Summary: An update for the idm:DL1 module is now available for Red Hat Enterprise Linux 8.1 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux AppStream EUS (v. 8.1) - aarch64, noarch, ppc64le, s390x, x86_64 3. Description: Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. Security Fix(es): * slapi-nis: NULL dereference (DoS) with specially crafted Binding DN (CVE-2021-3480) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1944640 - CVE-2021-3480 slapi-nis: NULL dereference (DoS) with speciallycrafted Binding DN 6. Package List: Red Hat Enterprise Linux AppStream EUS (v.8.1): Source: bind-dyndb-ldap-11.1-14.module+el8.1.0+4098+f286395e.src.rpm custodia-0.6.0-3.module+el8.1.0+4098+f286395e.src.rpm ipa-4.8.0-13.module+el8.1.0+4923+c6efe041.src.rpm ipa-healthcheck-0.3-4.module+el8.1.0+4098+f286395e.src.rpm ipa-idoverride-memberof-0.0.4-6.module+el8.1.0+4098+f286395e.src.rpm opendnssec-1.4.14-1.module+el8.1.0+4098+f286395e.src.rpm python-jwcrypto-0.5.0-1.module+el8.1.0+4098+f286395e.src.rpm python-kdcproxy-0.4-3.module+el8.1.0+4098+f286395e.src.rpm python-qrcode-5.1-12.module+el8.1.0+4098+f286395e.src.rpm python-yubico-1.3.2-9.module+el8.1.0+4098+f286395e.src.rpm pyusb-1.0.0-9.module+el8.1.0+4098+f286395e.src.rpm slapi-nis-0.56.3-3.module+el8.1.0+10781+dffa5bca.src.rpm softhsm-2.4.0-2.module+el8.1.0+4098+f286395e.src.rpm aarch64: bind-dyndb-ldap-11.1-14.module+el8.1.0+4098+f286395e.aarch64.rpm bind-dyndb-ldap-debuginfo-11.1-14.module+el8.1.0+4098+f286395e.aarch64.rpm bind-dyndb-ldap-debugsource-11.1-14.module+el8.1.0+4098+f286395e.aarch64.rpm ipa-client-4.8.0-13.module+el8.1.0+4923+c6efe041.aarch64.rpm ipa-client-debuginfo-4.8.0-13.module+el8.1.0+4923+c6efe041.aarch64.rpm ipa-client-samba-4.8.0-13.module+el8.1.0+4923+c6efe041.aarch64.rpm ipa-debuginfo-4.8.0-13.module+el8.1.0+4923+c6efe041.aarch64.rpm ipa-debugsource-4.8.0-13.module+el8.1.0+4923+c6efe041.aarch64.rpm ipa-idoverride-memberof-plugin-0.0.4-6.module+el8.1.0+4098+f286395e.aarch64.rpm ipa-server-4.8.0-13.module+el8.1.0+4923+c6efe041.aarch64.rpm ipa-server-debuginfo-4.8.0-13.module+el8.1.0+4923+c6efe041.aarch64.rpm ipa-server-trust-ad-4.8.0-13.module+el8.1.0+4923+c6efe041.aarch64.rpm ipa-server-trust-ad-debuginfo-4.8.0-13.module+el8.1.0+4923+c6efe041.aarch64.rpm opendnssec-1.4.14-1.module+el8.1.0+4098+f286395e.aarch64.rpm opendnssec-debuginfo-1.4.14-1.module+el8.1.0+4098+f286395e.aarch64.rpm opendnssec-debugsource-1.4.14-1.module+el8.1.0+4098+f286395e.aarch64.rpm slapi-nis-0.56.3-3.module+el8.1.0+10781+dffa5bca.aarch64.rpm slapi-nis-debuginfo-0.56.3-3.module+el8.1.0+10781+dffa5bca.aarch64.rpm slapi-nis-debugsource-0.56.3-3.module+el8.1.0+10781+dffa5bca.aarch64.rpm softhsm-2.4.0-2.module+el8.1.0+4098+f286395e.aarch64.rpm softhsm-debuginfo-2.4.0-2.module+el8.1.0+4098+f286395e.aarch64.rpm softhsm-debugsource-2.4.0-2.module+el8.1.0+4098+f286395e.aarch64.rpm softhsm-devel-2.4.0-2.module+el8.1.0+4098+f286395e.aarch64.rpm noarch: custodia-0.6.0-3.module+el8.1.0+4098+f286395e.noarch.rpm ipa-client-common-4.8.0-13.module+el8.1.0+4923+c6efe041.noarch.rpm ipa-common-4.8.0-13.module+el8.1.0+4923+c6efe041.noarch.rpm ipa-healthcheck-0.3-4.module+el8.1.0+4098+f286395e.noarch.rpm ipa-python-compat-4.8.0-13.module+el8.1.0+4923+c6efe041.noarch.rpm ipa-server-common-4.8.0-13.module+el8.1.0+4923+c6efe041.noarch.rpm ipa-server-dns-4.8.0-13.module+el8.1.0+4923+c6efe041.noarch.rpm python3-custodia-0.6.0-3.module+el8.1.0+4098+f286395e.noarch.rpm python3-ipaclient-4.8.0-13.module+el8.1.0+4923+c6efe041.noarch.rpm python3-ipalib-4.8.0-13.module+el8.1.0+4923+c6efe041.noarch.rpm python3-ipaserver-4.8.0-13.module+el8.1.0+4923+c6efe041.noarch.rpm python3-jwcrypto-0.5.0-1.module+el8.1.0+4098+f286395e.noarch.rpm python3-kdcproxy-0.4-3.module+el8.1.0+4098+f286395e.noarch.rpm python3-pyusb-1.0.0-9.module+el8.1.0+4098+f286395e.noarch.rpm python3-qrcode-5.1-12.module+el8.1.0+4098+f286395e.noarch.rpm python3-qrcode-core-5.1-12.module+el8.1.0+4098+f286395e.noarch.rpm python3-yubico-1.3.2-9.module+el8.1.0+4098+f286395e.noarch.rpm ppc64le: bind-dyndb-ldap-11.1-14.module+el8.1.0+4098+f286395e.ppc64le.rpm bind-dyndb-ldap-debuginfo-11.1-14.module+el8.1.0+4098+f286395e.ppc64le.rpm bind-dyndb-ldap-debugsource-11.1-14.module+el8.1.0+4098+f286395e.ppc64le.rpm ipa-client-4.8.0-13.module+el8.1.0+4923+c6efe041.ppc64le.rpm ipa-client-debuginfo-4.8.0-13.module+el8.1.0+4923+c6efe041.ppc64le.rpm ipa-client-samba-4.8.0-13.module+el8.1.0+4923+c6efe041.ppc64le.rpm ipa-debuginfo-4.8.0-13.module+el8.1.0+4923+c6efe041.ppc64le.rpm ipa-debugsource-4.8.0-13.module+el8.1.0+4923+c6efe041.ppc64le.rpm ipa-idoverride-memberof-plugin-0.0.4-6.module+el8.1.0+4098+f286395e.ppc64le.rpm ipa-server-4.8.0-13.module+el8.1.0+4923+c6efe041.ppc64le.rpm ipa-server-debuginfo-4.8.0-13.module+el8.1.0+4923+c6efe041.ppc64le.rpm ipa-server-trust-ad-4.8.0-13.module+el8.1.0+4923+c6efe041.ppc64le.rpm ipa-server-trust-ad-debuginfo-4.8.0-13.module+el8.1.0+4923+c6efe041.ppc64le.rpm opendnssec-1.4.14-1.module+el8.1.0+4098+f286395e.ppc64le.rpm opendnssec-debuginfo-1.4.14-1.module+el8.1.0+4098+f286395e.ppc64le.rpm opendnssec-debugsource-1.4.14-1.module+el8.1.0+4098+f286395e.ppc64le.rpm slapi-nis-0.56.3-3.module+el8.1.0+10781+dffa5bca.ppc64le.rpm slapi-nis-debuginfo-0.56.3-3.module+el8.1.0+10781+dffa5bca.ppc64le.rpm slapi-nis-debugsource-0.56.3-3.module+el8.1.0+10781+dffa5bca.ppc64le.rpm softhsm-2.4.0-2.module+el8.1.0+4098+f286395e.ppc64le.rpm softhsm-debuginfo-2.4.0-2.module+el8.1.0+4098+f286395e.ppc64le.rpm softhsm-debugsource-2.4.0-2.module+el8.1.0+4098+f286395e.ppc64le.rpm softhsm-devel-2.4.0-2.module+el8.1.0+4098+f286395e.ppc64le.rpm s390x: bind-dyndb-ldap-11.1-14.module+el8.1.0+4098+f286395e.s390x.rpm bind-dyndb-ldap-debuginfo-11.1-14.module+el8.1.0+4098+f286395e.s390x.rpm bind-dyndb-ldap-debugsource-11.1-14.module+el8.1.0+4098+f286395e.s390x.rpm ipa-client-4.8.0-13.module+el8.1.0+4923+c6efe041.s390x.rpm ipa-client-debuginfo-4.8.0-13.module+el8.1.0+4923+c6efe041.s390x.rpm ipa-client-samba-4.8.0-13.module+el8.1.0+4923+c6efe041.s390x.rpm ipa-debuginfo-4.8.0-13.module+el8.1.0+4923+c6efe041.s390x.rpm ipa-debugsource-4.8.0-13.module+el8.1.0+4923+c6efe041.s390x.rpm ipa-idoverride-memberof-plugin-0.0.4-6.module+el8.1.0+4098+f286395e.s390x.rpm ipa-server-4.8.0-13.module+el8.1.0+4923+c6efe041.s390x.rpm ipa-server-debuginfo-4.8.0-13.module+el8.1.0+4923+c6efe041.s390x.rpm ipa-server-trust-ad-4.8.0-13.module+el8.1.0+4923+c6efe041.s390x.rpm ipa-server-trust-ad-debuginfo-4.8.0-13.module+el8.1.0+4923+c6efe041.s390x.rpm opendnssec-1.4.14-1.module+el8.1.0+4098+f286395e.s390x.rpm opendnssec-debuginfo-1.4.14-1.module+el8.1.0+4098+f286395e.s390x.rpm opendnssec-debugsource-1.4.14-1.module+el8.1.0+4098+f286395e.s390x.rpm slapi-nis-0.56.3-3.module+el8.1.0+10781+dffa5bca.s390x.rpm slapi-nis-debuginfo-0.56.3-3.module+el8.1.0+10781+dffa5bca.s390x.rpm slapi-nis-debugsource-0.56.3-3.module+el8.1.0+10781+dffa5bca.s390x.rpm softhsm-2.4.0-2.module+el8.1.0+4098+f286395e.s390x.rpm softhsm-debuginfo-2.4.0-2.module+el8.1.0+4098+f286395e.s390x.rpm softhsm-debugsource-2.4.0-2.module+el8.1.0+4098+f286395e.s390x.rpm softhsm-devel-2.4.0-2.module+el8.1.0+4098+f286395e.s390x.rpm x86_64: bind-dyndb-ldap-11.1-14.module+el8.1.0+4098+f286395e.x86_64.rpm bind-dyndb-ldap-debuginfo-11.1-14.module+el8.1.0+4098+f286395e.x86_64.rpm bind-dyndb-ldap-debugsource-11.1-14.module+el8.1.0+4098+f286395e.x86_64.rpm ipa-client-4.8.0-13.module+el8.1.0+4923+c6efe041.x86_64.rpm ipa-client-debuginfo-4.8.0-13.module+el8.1.0+4923+c6efe041.x86_64.rpm ipa-client-samba-4.8.0-13.module+el8.1.0+4923+c6efe041.x86_64.rpm ipa-debuginfo-4.8.0-13.module+el8.1.0+4923+c6efe041.x86_64.rpm ipa-debugsource-4.8.0-13.module+el8.1.0+4923+c6efe041.x86_64.rpm ipa-idoverride-memberof-plugin-0.0.4-6.module+el8.1.0+4098+f286395e.x86_64.rpm ipa-server-4.8.0-13.module+el8.1.0+4923+c6efe041.x86_64.rpm ipa-server-debuginfo-4.8.0-13.module+el8.1.0+4923+c6efe041.x86_64.rpm ipa-server-trust-ad-4.8.0-13.module+el8.1.0+4923+c6efe041.x86_64.rpm ipa-server-trust-ad-debuginfo-4.8.0-13.module+el8.1.0+4923+c6efe041.x86_64.rpm opendnssec-1.4.14-1.module+el8.1.0+4098+f286395e.x86_64.rpm opendnssec-debuginfo-1.4.14-1.module+el8.1.0+4098+f286395e.x86_64.rpm opendnssec-debugsource-1.4.14-1.module+el8.1.0+4098+f286395e.x86_64.rpm slapi-nis-0.56.3-3.module+el8.1.0+10781+dffa5bca.x86_64.rpm slapi-nis-debuginfo-0.56.3-3.module+el8.1.0+10781+dffa5bca.x86_64.rpm slapi-nis-debugsource-0.56.3-3.module+el8.1.0+10781+dffa5bca.x86_64.rpm softhsm-2.4.0-2.module+el8.1.0+4098+f286395e.x86_64.rpm softhsm-debuginfo-2.4.0-2.module+el8.1.0+4098+f286395e.x86_64.rpm softhsm-debugsource-2.4.0-2.module+el8.1.0+4098+f286395e.x86_64.rpm softhsm-devel-2.4.0-2.module+el8.1.0+4098+f286395e.x86_64.rpm These packages are GPG signed by Red Hat for security. Our keyand details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2021-3480 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYKTPatzjgjWX9erEAQgqxhAAkWcml/KE2rzBx+I2ZCyo27qqCjpJZG0d VCKI/Hjgzas+9ELkwoJYdXiGhvI4fcIwA07Z2kWjC8vQb/sJnLMrmgxlpLeEPsmh LdituwScUb/19GOJAfvRSbG7Q4w+/ekwC1lFoUAjJGgoTdrj3RjZTU1zkZPaar85 JTDtMepW2U0a7yrQxeDDADq81JIVIkFe1kojr/sOqBDAWQt5SqtnrFJPs1EQftsz ROOE/S2xoaViYqw4SDE0gwuwCTVvmJk/i9alpJ9iMTrW4siVeCOUgWt2df6eA21q M0AFQKvsofzCt3hMum5RP3ZmWFx2nejkvllBGrecyxPOG/Vt7jlDtnefvkOSzyzY yacw7jqMK9KkPhxSv5WnGd7CjJsAppj1LVeay/9XHnAjbxuvM94cM/T7h1NDNKyV N9nFMuLrBUYI8Jcrko9ACRCTxko43duR8k9rfIsuE3jtLFqhD9xZ9u4/UPhzb+AC kEELjmFvO2V0Q6Fx9ZvN6orB+5wk3dIJY1AQhAc7qTHeZB8bizmd3zutnAKWppnE ZH5JMkumUUQCJfKWObXzmArvytNdUD9QpBNG8npphu8feDU6I3gWSeoM2cvMni1U aUWaYoR7gagkazZU1fSQEdGCssttE9SxUjmLAyJgD/Rs6R3tlQ4LIy1RFR5u4nbX AjWjgE8/zG0=peyV -----END PGP SIGNATURE----- -- RHSA-announce mailing list
May 19, 2021
•Important
Red Hat
98
security advisorysecurity issueRed Hat Enterprise LinuxRedHat Enterprise Linux 8: RHSA-2020-4670-01 Moderate Security Fix
An update for the idm:DL1 and idm:client modules is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: idm:DL1 and idm:client security, bug fix, and enhancement update Advisory ID: RHSA-2020:4670-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2020:4670 Issue date: 2020-11-03 CVE Names: CVE-2015-9251 CVE-2016-10735 CVE-2018-14040 CVE-2018-14042 CVE-2018-20676 CVE-2018-20677 CVE-2019-8331 CVE-2019-11358 CVE-2020-1722 CVE-2020-11022 ==================================================================== 1. Summary: An update for the idm:DL1 and idm:client modules is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux AppStream (v. 8) - aarch64, noarch, ppc64le, s390x, x86_64 3. Description: Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. The following packages have been upgraded to a later upstream version: ipa (4.8.7), softhsm (2.6.0), opendnssec (2.1.6). (BZ#1759888, BZ#1818765, BZ#1818877) Security Fix(es): * js-jquery: Cross-site scripting via cross-domain ajax requests (CVE-2015-9251) * bootstrap: XSS in the data-target attribute (CVE-2016-10735) * bootstrap: Cross-site Scripting (XSS)in the collapse data-parent attribute (CVE-2018-14040) * bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip (CVE-2018-14042) * bootstrap: XSS in the tooltip data-viewport attribute (CVE-2018-20676) * bootstrap: XSS in the affix configuration target property (CVE-2018-20677) * bootstrap: XSS in the tooltip or popover data-template attribute (CVE-2019-8331) * js-jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection (CVE-2019-11358) * jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022) * ipa: No password length restriction leads to denial of service (CVE-2020-1722) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes linked from the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1399546 - CVE-2015-9251 jquery: Cross-site scripting via cross-domain ajax requests 1430365 - [RFE] Host-group names command rename 1488732 - fake_mname in named.conf is no longer effective 1585020 - Enable compat tree to provide information about AD users and groups on trust agents 1601614 - CVE-2018-14040 bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute 1601617 - CVE-2018-14042 bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip 1651577 - [WebUI] IPA Error 3007: RequirmentError" while adding members in "User ID overrides" tab 1668082 - CVE-2018-20676 bootstrap: XSS in the tooltip data-viewport attribute 1668089 - CVE-2018-20677 bootstrap: XSS in the affix configuration target property 1668097 -CVE-2016-10735 bootstrap: XSS in the data-target attribute 1686454 - CVE-2019-8331 bootstrap: XSS in the tooltip or popover data-template attribute 1701233 - [RFE] support setting supported signature methods on the token 1701972 - CVE-2019-11358 jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection 1746830 - Memory leak during search of idview overrides 1750893 - Memory leak when slapi-nis return entries retrieved from nsswitch 1751295 - When sync-repl is enabled, slapi-nis can deadlock during retrochanglog trimming 1757045 - IDM Web GUI / IPA web UI: the ID override operation doesn't work in GUI (it works only from CLI) 1759888 - Rebase OpenDNSSEC to 2.1 1768156 - ERR - schemacompat - map rdlock: old way MAP_MONITOR_DISABLED 1777806 - When Service weight is set as 0 for server in IPA location "IPA Error 903: InternalError" is displayed 1793071 - CVE-2020-1722 ipa: No password length restriction leads to denial of service 1801698 - [RFE] Changing default hostgroup is too easy 1802471 - SELinux policy for ipa-custodia 1809835 - RFE: ipa group-add-member: number of failed should also be emphasized 1810154 - RFE: ipa-backup should compare locally and globally installed server roles 1810179 - ipa-client-install should name authselect backups and restore to that at uninstall time 1813330 - ipa-restore does not restart httpd 1816784 - KRA install fails if all KRA members are Hidden Replicas 1818765 - [Rebase] Rebase ipa to 4.8.6+ 1818877 - [Rebase] Rebase to softhsm 2.6.0+ 1828406 - CVE-2020-11022 jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method 1831732 - AVC avc: denied { dac_override } for comm="ods-enforcerd 1831935 - AD authentication with IdM against SQL Server 1832331 - [abrt] [faf] 389-ds-base: unknown function(): /usr/sbin/ns-slapd killed by 11 1833266 - [dirsrv] set 'nsslapd-enable-upgrade-hash: off' as this raises warnings 1834264 - BIND rebase: rebuild against new so version 1834909 - softhsm use-after-freeon process exit 1845211 - Rebase bind-dyndb-ldap to 11.3 1845537 - IPA bind configuration issue 1845596 - ipa trust-add fails with 'Fetching domains from trusted forest failed' 1846352 - cannot issue certs with multiple IP addresses corresponding to different hosts 1846434 - Remove ipa-idoverride-memberof as superceded by ipa-server 4.8.7 1847999 - EPN does not ship its default configuration ( /etc/ipa/epn.conf ) in freeipa-client-epn 1849914 - FreeIPA - Utilize 256-bit AJP connector passwords 1851411 - ipa: typo issue in ipanthomedirectoryrive deffinition 1852244 - ipa-healthcheck inadvertently obsoleted in RHEL 8.2 1853263 - ipa-selinux package missing 1857157 - replica install failing with avc denial for custodia component 1858318 - AttributeError: module 'ssl' has no attribute 'SSLCertVerificationError' when upgrading ca-less ipa master 1859213 - AVC denial during ipa-adtrust-install --add-agents 1863079 - ipa-epn command displays 'exception: ConnectionRefusedError: [Errno 111] Connection refused' 1863616 - CA-less install does not set required permissions on KDC certificate 1866291 - EPN: enhance input validation 1866938 - ipa-epn fails to retrieve user data if some user attributes are not present 1868432 - Unhandled Python exception in '/usr/libexec/ipa/ipa-pki-retrieve-key' 1869311 - ipa trust-add fails with 'Fetching domains from trusted forest failed' 1870202 - File permissions of /etc/ipa/ca.crt differ between CA-ful and CA-less 1874015 - ipa hbacrule-add-service --hbacsvcs=sshd is not applied successfully for subdomain 1875348 - Valgrind reports a memory leak in the Schema Compatibility plugin. 1879604 - pkispawn logs files are empty 6. Package List: Red Hat Enterprise Linux AppStream (v.8): Source: bind-dyndb-ldap-11.3-1.module+el8.3.0+6993+104f8db0.src.rpm custodia-0.6.0-3.module+el8.1.0+4098+f286395e.src.rpm ipa-4.8.7-12.module+el8.3.0+8222+c1bff54a.src.rpm ipa-4.8.7-12.module+el8.3.0+8223+6212645f.src.rpm ipa-healthcheck-0.4-6.module+el8.3.0+7710+e2408ce4.src.rpm ipa-healthcheck-0.4-6.module+el8.3.0+7711+c4441980.src.rpm opendnssec-2.1.6-2.module+el8.3.0+6580+328a3362.src.rpm python-jwcrypto-0.5.0-1.module+el8.1.0+4098+f286395e.src.rpm python-jwcrypto-0.5.0-1.module+el8.1.0+4107+4a66eb87.src.rpm python-kdcproxy-0.4-5.module+el8.2.0+4691+a05b2456.src.rpm python-qrcode-5.1-12.module+el8.1.0+4098+f286395e.src.rpm python-qrcode-5.1-12.module+el8.1.0+4107+4a66eb87.src.rpm python-yubico-1.3.2-9.module+el8.1.0+4098+f286395e.src.rpm python-yubico-1.3.2-9.module+el8.1.0+4107+4a66eb87.src.rpm pyusb-1.0.0-9.module+el8.1.0+4098+f286395e.src.rpm pyusb-1.0.0-9.module+el8.1.0+4107+4a66eb87.src.rpm slapi-nis-0.56.5-4.module+el8.3.0+8222+c1bff54a.src.rpm softhsm-2.6.0-3.module+el8.3.0+6909+fb33717d.src.rpm aarch64: bind-dyndb-ldap-11.3-1.module+el8.3.0+6993+104f8db0.aarch64.rpm bind-dyndb-ldap-debuginfo-11.3-1.module+el8.3.0+6993+104f8db0.aarch64.rpm bind-dyndb-ldap-debugsource-11.3-1.module+el8.3.0+6993+104f8db0.aarch64.rpm ipa-client-4.8.7-12.module+el8.3.0+8222+c1bff54a.aarch64.rpm ipa-client-4.8.7-12.module+el8.3.0+8223+6212645f.aarch64.rpm ipa-client-debuginfo-4.8.7-12.module+el8.3.0+8222+c1bff54a.aarch64.rpm ipa-client-debuginfo-4.8.7-12.module+el8.3.0+8223+6212645f.aarch64.rpm ipa-client-epn-4.8.7-12.module+el8.3.0+8222+c1bff54a.aarch64.rpm ipa-client-epn-4.8.7-12.module+el8.3.0+8223+6212645f.aarch64.rpm ipa-client-samba-4.8.7-12.module+el8.3.0+8222+c1bff54a.aarch64.rpm ipa-client-samba-4.8.7-12.module+el8.3.0+8223+6212645f.aarch64.rpm ipa-debuginfo-4.8.7-12.module+el8.3.0+8222+c1bff54a.aarch64.rpm ipa-debuginfo-4.8.7-12.module+el8.3.0+8223+6212645f.aarch64.rpm ipa-debugsource-4.8.7-12.module+el8.3.0+8222+c1bff54a.aarch64.rpm ipa-debugsource-4.8.7-12.module+el8.3.0+8223+6212645f.aarch64.rpm ipa-server-4.8.7-12.module+el8.3.0+8222+c1bff54a.aarch64.rpm ipa-server-debuginfo-4.8.7-12.module+el8.3.0+8222+c1bff54a.aarch64.rpm ipa-server-trust-ad-4.8.7-12.module+el8.3.0+8222+c1bff54a.aarch64.rpm ipa-server-trust-ad-debuginfo-4.8.7-12.module+el8.3.0+8222+c1bff54a.aarch64.rpm opendnssec-2.1.6-2.module+el8.3.0+6580+328a3362.aarch64.rpm opendnssec-debuginfo-2.1.6-2.module+el8.3.0+6580+328a3362.aarch64.rpm opendnssec-debugsource-2.1.6-2.module+el8.3.0+6580+328a3362.aarch64.rpm slapi-nis-0.56.5-4.module+el8.3.0+8222+c1bff54a.aarch64.rpm slapi-nis-debuginfo-0.56.5-4.module+el8.3.0+8222+c1bff54a.aarch64.rpm slapi-nis-debugsource-0.56.5-4.module+el8.3.0+8222+c1bff54a.aarch64.rpm softhsm-2.6.0-3.module+el8.3.0+6909+fb33717d.aarch64.rpm softhsm-debuginfo-2.6.0-3.module+el8.3.0+6909+fb33717d.aarch64.rpm softhsm-debugsource-2.6.0-3.module+el8.3.0+6909+fb33717d.aarch64.rpm softhsm-devel-2.6.0-3.module+el8.3.0+6909+fb33717d.aarch64.rpm noarch: custodia-0.6.0-3.module+el8.1.0+4098+f286395e.noarch.rpm ipa-client-common-4.8.7-12.module+el8.3.0+8222+c1bff54a.noarch.rpm ipa-client-common-4.8.7-12.module+el8.3.0+8223+6212645f.noarch.rpm ipa-common-4.8.7-12.module+el8.3.0+8222+c1bff54a.noarch.rpm ipa-common-4.8.7-12.module+el8.3.0+8223+6212645f.noarch.rpm ipa-healthcheck-0.4-6.module+el8.3.0+7710+e2408ce4.noarch.rpm ipa-healthcheck-core-0.4-6.module+el8.3.0+7710+e2408ce4.noarch.rpm ipa-healthcheck-core-0.4-6.module+el8.3.0+7711+c4441980.noarch.rpm ipa-python-compat-4.8.7-12.module+el8.3.0+8222+c1bff54a.noarch.rpm ipa-python-compat-4.8.7-12.module+el8.3.0+8223+6212645f.noarch.rpm ipa-selinux-4.8.7-12.module+el8.3.0+8222+c1bff54a.noarch.rpm ipa-selinux-4.8.7-12.module+el8.3.0+8223+6212645f.noarch.rpm ipa-server-common-4.8.7-12.module+el8.3.0+8222+c1bff54a.noarch.rpm ipa-server-dns-4.8.7-12.module+el8.3.0+8222+c1bff54a.noarch.rpm python3-custodia-0.6.0-3.module+el8.1.0+4098+f286395e.noarch.rpm python3-ipaclient-4.8.7-12.module+el8.3.0+8222+c1bff54a.noarch.rpm python3-ipaclient-4.8.7-12.module+el8.3.0+8223+6212645f.noarch.rpm python3-ipalib-4.8.7-12.module+el8.3.0+8222+c1bff54a.noarch.rpm python3-ipalib-4.8.7-12.module+el8.3.0+8223+6212645f.noarch.rpm python3-ipaserver-4.8.7-12.module+el8.3.0+8222+c1bff54a.noarch.rpm python3-jwcrypto-0.5.0-1.module+el8.1.0+4098+f286395e.noarch.rpm python3-jwcrypto-0.5.0-1.module+el8.1.0+4107+4a66eb87.noarch.rpm python3-kdcproxy-0.4-5.module+el8.2.0+4691+a05b2456.noarch.rpm python3-pyusb-1.0.0-9.module+el8.1.0+4098+f286395e.noarch.rpm python3-pyusb-1.0.0-9.module+el8.1.0+4107+4a66eb87.noarch.rpm python3-qrcode-5.1-12.module+el8.1.0+4098+f286395e.noarch.rpm python3-qrcode-5.1-12.module+el8.1.0+4107+4a66eb87.noarch.rpm python3-qrcode-core-5.1-12.module+el8.1.0+4098+f286395e.noarch.rpm python3-qrcode-core-5.1-12.module+el8.1.0+4107+4a66eb87.noarch.rpm python3-yubico-1.3.2-9.module+el8.1.0+4098+f286395e.noarch.rpm python3-yubico-1.3.2-9.module+el8.1.0+4107+4a66eb87.noarch.rpm ppc64le: bind-dyndb-ldap-11.3-1.module+el8.3.0+6993+104f8db0.ppc64le.rpm bind-dyndb-ldap-debuginfo-11.3-1.module+el8.3.0+6993+104f8db0.ppc64le.rpm bind-dyndb-ldap-debugsource-11.3-1.module+el8.3.0+6993+104f8db0.ppc64le.rpm ipa-client-4.8.7-12.module+el8.3.0+8222+c1bff54a.ppc64le.rpm ipa-client-4.8.7-12.module+el8.3.0+8223+6212645f.ppc64le.rpm ipa-client-debuginfo-4.8.7-12.module+el8.3.0+8222+c1bff54a.ppc64le.rpm ipa-client-debuginfo-4.8.7-12.module+el8.3.0+8223+6212645f.ppc64le.rpm ipa-client-epn-4.8.7-12.module+el8.3.0+8222+c1bff54a.ppc64le.rpm ipa-client-epn-4.8.7-12.module+el8.3.0+8223+6212645f.ppc64le.rpm ipa-client-samba-4.8.7-12.module+el8.3.0+8222+c1bff54a.ppc64le.rpm ipa-client-samba-4.8.7-12.module+el8.3.0+8223+6212645f.ppc64le.rpm ipa-debuginfo-4.8.7-12.module+el8.3.0+8222+c1bff54a.ppc64le.rpm ipa-debuginfo-4.8.7-12.module+el8.3.0+8223+6212645f.ppc64le.rpm ipa-debugsource-4.8.7-12.module+el8.3.0+8222+c1bff54a.ppc64le.rpm ipa-debugsource-4.8.7-12.module+el8.3.0+8223+6212645f.ppc64le.rpm ipa-server-4.8.7-12.module+el8.3.0+8222+c1bff54a.ppc64le.rpm ipa-server-debuginfo-4.8.7-12.module+el8.3.0+8222+c1bff54a.ppc64le.rpm ipa-server-trust-ad-4.8.7-12.module+el8.3.0+8222+c1bff54a.ppc64le.rpm ipa-server-trust-ad-debuginfo-4.8.7-12.module+el8.3.0+8222+c1bff54a.ppc64le.rpm opendnssec-2.1.6-2.module+el8.3.0+6580+328a3362.ppc64le.rpm opendnssec-debuginfo-2.1.6-2.module+el8.3.0+6580+328a3362.ppc64le.rpm opendnssec-debugsource-2.1.6-2.module+el8.3.0+6580+328a3362.ppc64le.rpm slapi-nis-0.56.5-4.module+el8.3.0+8222+c1bff54a.ppc64le.rpm slapi-nis-debuginfo-0.56.5-4.module+el8.3.0+8222+c1bff54a.ppc64le.rpm slapi-nis-debugsource-0.56.5-4.module+el8.3.0+8222+c1bff54a.ppc64le.rpm softhsm-2.6.0-3.module+el8.3.0+6909+fb33717d.ppc64le.rpm softhsm-debuginfo-2.6.0-3.module+el8.3.0+6909+fb33717d.ppc64le.rpm softhsm-debugsource-2.6.0-3.module+el8.3.0+6909+fb33717d.ppc64le.rpm softhsm-devel-2.6.0-3.module+el8.3.0+6909+fb33717d.ppc64le.rpm s390x: bind-dyndb-ldap-11.3-1.module+el8.3.0+6993+104f8db0.s390x.rpm bind-dyndb-ldap-debuginfo-11.3-1.module+el8.3.0+6993+104f8db0.s390x.rpm bind-dyndb-ldap-debugsource-11.3-1.module+el8.3.0+6993+104f8db0.s390x.rpm ipa-client-4.8.7-12.module+el8.3.0+8222+c1bff54a.s390x.rpm ipa-client-4.8.7-12.module+el8.3.0+8223+6212645f.s390x.rpm ipa-client-debuginfo-4.8.7-12.module+el8.3.0+8222+c1bff54a.s390x.rpm ipa-client-debuginfo-4.8.7-12.module+el8.3.0+8223+6212645f.s390x.rpm ipa-client-epn-4.8.7-12.module+el8.3.0+8222+c1bff54a.s390x.rpm ipa-client-epn-4.8.7-12.module+el8.3.0+8223+6212645f.s390x.rpm ipa-client-samba-4.8.7-12.module+el8.3.0+8222+c1bff54a.s390x.rpm ipa-client-samba-4.8.7-12.module+el8.3.0+8223+6212645f.s390x.rpm ipa-debuginfo-4.8.7-12.module+el8.3.0+8222+c1bff54a.s390x.rpm ipa-debuginfo-4.8.7-12.module+el8.3.0+8223+6212645f.s390x.rpm ipa-debugsource-4.8.7-12.module+el8.3.0+8222+c1bff54a.s390x.rpm ipa-debugsource-4.8.7-12.module+el8.3.0+8223+6212645f.s390x.rpm ipa-server-4.8.7-12.module+el8.3.0+8222+c1bff54a.s390x.rpm ipa-server-debuginfo-4.8.7-12.module+el8.3.0+8222+c1bff54a.s390x.rpm ipa-server-trust-ad-4.8.7-12.module+el8.3.0+8222+c1bff54a.s390x.rpm ipa-server-trust-ad-debuginfo-4.8.7-12.module+el8.3.0+8222+c1bff54a.s390x.rpm opendnssec-2.1.6-2.module+el8.3.0+6580+328a3362.s390x.rpm opendnssec-debuginfo-2.1.6-2.module+el8.3.0+6580+328a3362.s390x.rpm opendnssec-debugsource-2.1.6-2.module+el8.3.0+6580+328a3362.s390x.rpm slapi-nis-0.56.5-4.module+el8.3.0+8222+c1bff54a.s390x.rpm slapi-nis-debuginfo-0.56.5-4.module+el8.3.0+8222+c1bff54a.s390x.rpm slapi-nis-debugsource-0.56.5-4.module+el8.3.0+8222+c1bff54a.s390x.rpm softhsm-2.6.0-3.module+el8.3.0+6909+fb33717d.s390x.rpm softhsm-debuginfo-2.6.0-3.module+el8.3.0+6909+fb33717d.s390x.rpm softhsm-debugsource-2.6.0-3.module+el8.3.0+6909+fb33717d.s390x.rpm softhsm-devel-2.6.0-3.module+el8.3.0+6909+fb33717d.s390x.rpm x86_64: bind-dyndb-ldap-11.3-1.module+el8.3.0+6993+104f8db0.x86_64.rpm bind-dyndb-ldap-debuginfo-11.3-1.module+el8.3.0+6993+104f8db0.x86_64.rpm bind-dyndb-ldap-debugsource-11.3-1.module+el8.3.0+6993+104f8db0.x86_64.rpm ipa-client-4.8.7-12.module+el8.3.0+8222+c1bff54a.x86_64.rpm ipa-client-4.8.7-12.module+el8.3.0+8223+6212645f.x86_64.rpm ipa-client-debuginfo-4.8.7-12.module+el8.3.0+8222+c1bff54a.x86_64.rpm ipa-client-debuginfo-4.8.7-12.module+el8.3.0+8223+6212645f.x86_64.rpm ipa-client-epn-4.8.7-12.module+el8.3.0+8222+c1bff54a.x86_64.rpm ipa-client-epn-4.8.7-12.module+el8.3.0+8223+6212645f.x86_64.rpm ipa-client-samba-4.8.7-12.module+el8.3.0+8222+c1bff54a.x86_64.rpm ipa-client-samba-4.8.7-12.module+el8.3.0+8223+6212645f.x86_64.rpm ipa-debuginfo-4.8.7-12.module+el8.3.0+8222+c1bff54a.x86_64.rpm ipa-debuginfo-4.8.7-12.module+el8.3.0+8223+6212645f.x86_64.rpm ipa-debugsource-4.8.7-12.module+el8.3.0+8222+c1bff54a.x86_64.rpm ipa-debugsource-4.8.7-12.module+el8.3.0+8223+6212645f.x86_64.rpm ipa-server-4.8.7-12.module+el8.3.0+8222+c1bff54a.x86_64.rpm ipa-server-debuginfo-4.8.7-12.module+el8.3.0+8222+c1bff54a.x86_64.rpm ipa-server-trust-ad-4.8.7-12.module+el8.3.0+8222+c1bff54a.x86_64.rpm ipa-server-trust-ad-debuginfo-4.8.7-12.module+el8.3.0+8222+c1bff54a.x86_64.rpm opendnssec-2.1.6-2.module+el8.3.0+6580+328a3362.x86_64.rpm opendnssec-debuginfo-2.1.6-2.module+el8.3.0+6580+328a3362.x86_64.rpm opendnssec-debugsource-2.1.6-2.module+el8.3.0+6580+328a3362.x86_64.rpm slapi-nis-0.56.5-4.module+el8.3.0+8222+c1bff54a.x86_64.rpm slapi-nis-debuginfo-0.56.5-4.module+el8.3.0+8222+c1bff54a.x86_64.rpm slapi-nis-debugsource-0.56.5-4.module+el8.3.0+8222+c1bff54a.x86_64.rpm softhsm-2.6.0-3.module+el8.3.0+6909+fb33717d.x86_64.rpm softhsm-debuginfo-2.6.0-3.module+el8.3.0+6909+fb33717d.x86_64.rpm softhsm-debugsource-2.6.0-3.module+el8.3.0+6909+fb33717d.x86_64.rpm softhsm-devel-2.6.0-3.module+el8.3.0+6909+fb33717d.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2015-9251 https://access.redhat.com/security/cve/CVE-2016-10735 https://access.redhat.com/security/cve/CVE-2018-14040 https://access.redhat.com/security/cve/CVE-2018-14042 https://access.redhat.com/security/cve/CVE-2018-20676 https://access.redhat.com/security/cve/CVE-2018-20677 https://access.redhat.com/security/cve/CVE-2019-8331 https://access.redhat.com/security/cve/CVE-2019-11358 https://access.redhat.com/security/cve/CVE-2020-1722 https://access.redhat.com/security/cve/CVE-2020-11022 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.3_release_notes/ 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPGv1 iQIVAwUBX6I0xtzjgjWX9erEAQioFw/+IiVoE8tPMkiNgSNrk05OezzG/Cev8wXY mTJ+clSxujruzDZ1GyYz5Ua5v4+fwEHbTKVHiite3HKbYGgV9E5H9Y/JVR75rbPN mIfAOLmvYDp3JeHT3RBqRrtviz2UaWRTmE8E30EoC0C912w0NHpwS3fhuRmJov1X lflTtWlQCuPE/7yFQEZqYYjmKMqAVeDk4K6smM/aTzMyM+uFgaksiSTrLzU0mcHJ AAn9h59qlwUXNGRbyBCoLMJrKq5Sw1+xz518XIIjJOQDJbSqu8syzKgi/qSFuLRp 2c/OSKJ98CVoiCcyhsBW/c3B6eoDmSfeKqt6JwVH/Sva+d7Oj5vpWTB5GW4hDFFh t3cuhvyavPnyAzxRnYw5syn/RTyjaOK1U6+6SbEtJVnlx9+FW0lKs/Pcx2ocYmfO UCDXHgxmEP8DTKwJZyIZtybVkpqbXh6jf69NLROTTZMtEwJzE1NGG4ulcl6tutTq S0gchuiUuxItZlD3a9ISBXXxV0iqqd7I5p78maohzIwfyZR13S++rFt7JnoVb7SO DECfEs6VinGH0Z0YInceF6Y9N+SURBrcQpQK12/wtGSChFFU83FII2sxy6iG7pTF HPTzByu+aYgFpuEF4EKSrDlZCVJ8Es5lyp+cF401o3oGJuNo9WYScKjb51a0+SLJ zbmM3GoiGZI=QyyK -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Nov 03, 2020
Red Hat
98
security advisoryred hatbug fixRed Hat 6 RHSA-2015:1462-01 Moderate: ipa XSS Security Issues
Updated ipa packages that fix two security issues and several bugs are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security [More...]. ==================================================================== Red Hat Security Advisory Synopsis: Moderate: ipa security and bug fix update Advisory ID: RHSA-2015:1462-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2015:1462.html Issue date: 2015-07-22 Updated on: 2015-03-04 CVE Names: CVE-2010-5312 CVE-2012-6662 ==================================================================== 1. Summary: Updated ipa packages that fix two security issues and several bugs are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64 Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64 Red Hat Enterprise Linux HPC Node (v. 6) - x86_64 Red Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64 Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64 3. Description: Two cross-site scripting (XSS) flaws were found in jQuery, which impacted the Identity Management web administrative interface, and could allow an authenticated user to inject arbitrary HTML or web script into the interface. (CVE-2010-5312, CVE-2012-6662) Note: The IdM version provided by this update no longer uses jQuery. Bug fixes: * Theipa-server-install, ipa-replica-install, and ipa-client-install utilities are not supported on machines running in FIPS-140 mode. Previously, IdM did not warn users about this. Now, IdM does not allow running the utilities in FIPS-140 mode, and displays an explanatory message. (BZ#1131571) * If an Active Directory (AD) server was specified or discovered automatically when running the ipa-client-install utility, the utility produced a traceback instead of informing the user that an IdM server is expected in this situation. Now, ipa-client-install detects the AD server and fails with an explanatory message. (BZ#1132261) * When IdM servers were configured to require the TLS protocol version 1.1 (TLSv1.1) or later in the httpd server, the ipa utility failed. With this update, running ipa works as expected with TLSv1.1 or later. (BZ#1154687) * In certain high-load environments, the Kerberos authentication step of the IdM client installer can fail. Previously, the entire client installation failed in this situation. This update modifies ipa-client-install to prefer the TCP protocol over the UDP protocol and to retry the authentication attempt in case of failure. (BZ#1161722) * If ipa-client-install updated or created the /etc/nsswitch.conf file, the sudo utility could terminate unexpectedly with a segmentation fault. Now, ipa-client-install puts a new line character at the end of nsswitch.conf if it modifies the last line of the file, fixing this bug. (BZ#1185207) * The ipa-client-automount utility failed with the "UNWILLING_TO_PERFORM" LDAP error when the nsslapd-minssf Red Hat Directory Server configuration parameter was set to "1". This update modifies ipa-client-automount to use encrypted connection for LDAP searches by default, and the utility now finishes successfully even with nsslapd-minssf specified. (BZ#1191040) * If installing an IdM server failed after the Certificate Authority (CA) installation, the "ipa-server-install --uninstall" command did not perform a proper cleanup. After the user issued"ipa-server-install --uninstall" and then attempted to install the server again, the installation failed. Now, "ipa-server-install --uninstall" removes the CA-related files in the described situation, and ipa-server-install no longer fails with the mentioned error message. (BZ#1198160) * Running ipa-client-install added the "sss" entry to the sudoers line in nsswitch.conf even if "sss" was already configured and the entry was present in the file. Duplicate "sss" then caused sudo to become unresponsive. Now, ipa-client-install no longer adds "sss" if it is already present in nsswitch.conf. (BZ#1198339) * After running ipa-client-install, it was not possible to log in using SSH under certain circumstances. Now, ipa-client-install no longer corrupts the sshd_config file, and the sshd service can start as expected, and logging in using SSH works in the described situation. (BZ#1201454) * An incorrect definition of the dc attribute in the /usr/share/ipa/05rfc2247.ldif file caused bogus error messages to be returned during migration. The attribute has been fixed, but the bug persists if the copy-schema-to-ca.py script was run on Red Hat Enterprise Linux 6.6 prior to running it on Red Hat Enterprise Linux 6.7. To work around this problem, manually copy /usr/share/ipa/schema/05rfc2247.ldif to /etc/dirsrv/slapd-PKI-IPA/schema/ and restart IdM. (BZ#1220788) All ipa users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1132261 - ipa-client-install failing produces a traceback instead of useful error message 1146870 - ipa-client-install fails with "KerbTransport instance has no attribute '__conn'" traceback 1154687 - POODLE: force using safe ciphers (non-SSLv3) in IPA client and server 1166041 -CVE-2010-5312 jquery-ui: XSS vulnerability in jQuery.ui.dialog title option 1166064 - CVE-2012-6662 jquery-ui: XSS vulnerability in default content in Tooltip widget 1185207 - ipa-client dont end new line character in /etc/nsswitch.conf 1198339 - ipa-client-install adds extra sss to sudoers in nsswitch.conf 1201454 - ipa breaks sshd config 1205660 - ipa-client rpm should require keyutils 1207649 - host certificate not issued to client during ipa-client-install 1220788 - request to backport ticket 3578 to RHEL6. Provoking migration to 7.1 issues. 6. Package List: Red Hat Enterprise Linux Desktop (v. 6): Source: ipa-3.0.0-47.el6.src.rpm i386: ipa-client-3.0.0-47.el6.i686.rpm ipa-debuginfo-3.0.0-47.el6.i686.rpm ipa-python-3.0.0-47.el6.i686.rpm x86_64: ipa-client-3.0.0-47.el6.x86_64.rpm ipa-debuginfo-3.0.0-47.el6.x86_64.rpm ipa-python-3.0.0-47.el6.x86_64.rpm Red Hat Enterprise Linux Desktop Optional (v. 6): i386: ipa-admintools-3.0.0-47.el6.i686.rpm ipa-debuginfo-3.0.0-47.el6.i686.rpm ipa-server-3.0.0-47.el6.i686.rpm ipa-server-selinux-3.0.0-47.el6.i686.rpm ipa-server-trust-ad-3.0.0-47.el6.i686.rpm x86_64: ipa-admintools-3.0.0-47.el6.x86_64.rpm ipa-debuginfo-3.0.0-47.el6.x86_64.rpm ipa-server-3.0.0-47.el6.x86_64.rpm ipa-server-selinux-3.0.0-47.el6.x86_64.rpm ipa-server-trust-ad-3.0.0-47.el6.x86_64.rpm Red Hat Enterprise Linux HPC Node (v. 6): Source: ipa-3.0.0-47.el6.src.rpm x86_64: ipa-client-3.0.0-47.el6.x86_64.rpm ipa-debuginfo-3.0.0-47.el6.x86_64.rpm ipa-python-3.0.0-47.el6.x86_64.rpm Red Hat Enterprise Linux HPC Node Optional (v. 6): x86_64: ipa-admintools-3.0.0-47.el6.x86_64.rpm ipa-debuginfo-3.0.0-47.el6.x86_64.rpm ipa-server-3.0.0-47.el6.x86_64.rpm ipa-server-selinux-3.0.0-47.el6.x86_64.rpm ipa-server-trust-ad-3.0.0-47.el6.x86_64.rpm Red Hat Enterprise Linux Server (v.6): Source: ipa-3.0.0-47.el6.src.rpm i386: ipa-admintools-3.0.0-47.el6.i686.rpm ipa-client-3.0.0-47.el6.i686.rpm ipa-debuginfo-3.0.0-47.el6.i686.rpm ipa-python-3.0.0-47.el6.i686.rpm ipa-server-3.0.0-47.el6.i686.rpm ipa-server-selinux-3.0.0-47.el6.i686.rpm ipa-server-trust-ad-3.0.0-47.el6.i686.rpm ppc64: ipa-admintools-3.0.0-47.el6.ppc64.rpm ipa-client-3.0.0-47.el6.ppc64.rpm ipa-debuginfo-3.0.0-47.el6.ppc64.rpm ipa-python-3.0.0-47.el6.ppc64.rpm s390x: ipa-admintools-3.0.0-47.el6.s390x.rpm ipa-client-3.0.0-47.el6.s390x.rpm ipa-debuginfo-3.0.0-47.el6.s390x.rpm ipa-python-3.0.0-47.el6.s390x.rpm x86_64: ipa-admintools-3.0.0-47.el6.x86_64.rpm ipa-client-3.0.0-47.el6.x86_64.rpm ipa-debuginfo-3.0.0-47.el6.x86_64.rpm ipa-python-3.0.0-47.el6.x86_64.rpm ipa-server-3.0.0-47.el6.x86_64.rpm ipa-server-selinux-3.0.0-47.el6.x86_64.rpm ipa-server-trust-ad-3.0.0-47.el6.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 6): Source: ipa-3.0.0-47.el6.src.rpm i386: ipa-admintools-3.0.0-47.el6.i686.rpm ipa-client-3.0.0-47.el6.i686.rpm ipa-debuginfo-3.0.0-47.el6.i686.rpm ipa-python-3.0.0-47.el6.i686.rpm ipa-server-3.0.0-47.el6.i686.rpm ipa-server-selinux-3.0.0-47.el6.i686.rpm ipa-server-trust-ad-3.0.0-47.el6.i686.rpm x86_64: ipa-admintools-3.0.0-47.el6.x86_64.rpm ipa-client-3.0.0-47.el6.x86_64.rpm ipa-debuginfo-3.0.0-47.el6.x86_64.rpm ipa-python-3.0.0-47.el6.x86_64.rpm ipa-server-3.0.0-47.el6.x86_64.rpm ipa-server-selinux-3.0.0-47.el6.x86_64.rpm ipa-server-trust-ad-3.0.0-47.el6.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key 7. References: https://access.redhat.com/security/cve/CVE-2010-5312 https://access.redhat.com/security/cve/CVE-2012-6662 https://access.redhat.com/security/updates/classification#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2015 Red Hat, Inc. . Canonical's Timely securityupdate outlines kernel patches for critical vulnerabilities and enhancements for Ubuntu 20.04, reinforcing system integrity.. ipa Security, Red Hat Update, RHEL 6 Advisory, Moderate Security Fixes, XSS Vulnerability. . LinuxSecurity.com Team
Jul 22, 2015
Red Hat
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!