Summary
[4.6.5-11.0.1]
- Blank out header-logo.png product-name.png
- Replace login-screen-logo.png [Orabug: 20362818]
[4.6.5-11.el7_7.4]
- Resolves: #1781153 - After upgrade AD Trust Agents were removed from LDAP
- trust upgrade: ensure that host is member of adtrust agents
- Resolves: #1777303 - CVE-2019-10195 ipa: batch API logging user passwords to /var/log/httpd/error_log
- CVE-2019-10195: Don't log passwords embedded in commands in calls using batch
- Resolves: #1773953 - User incorrectly added to negative cache when backend is reconnecting to IPA service / timed out: error code 32 'No such object'
- extdom: unify error code handling especially LDAP_NO_SUCH_OBJECT
- ipa-extdom-extop: test timed out getgrgid_r
- Resolves: #1770728 - Issue with adding multiple RHEL 7 IPA replica to RHEL 6 IPA master
- DL0 replica install: fix nsDS5ReplicaBindDN config
- Resolves: #1767300 - CVE-2019-14867 ipa: Denial of service in IPA server due to wrong use of ber_scanf()
- Make sure to have storage space for tag
Fixed packages 11
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | ipa-client | 0:4.6.5-11.0.1.el7_7.4 |
| Oracle Linux · 7 | ipa-client-common | 0:4.6.5-11.0.1.el7_7.4 |
| Oracle Linux · 7 | ipa-common | 0:4.6.5-11.0.1.el7_7.4 |
| Oracle Linux · 7 | ipa-python-compat | 0:4.6.5-11.0.1.el7_7.4 |
| Oracle Linux · 7 | ipa-server | 0:4.6.5-11.0.1.el7_7.4 |
| Oracle Linux · 7 | ipa-server-common | 0:4.6.5-11.0.1.el7_7.4 |
| Oracle Linux · 7 | ipa-server-dns | 0:4.6.5-11.0.1.el7_7.4 |
| Oracle Linux · 7 | ipa-server-trust-ad | 0:4.6.5-11.0.1.el7_7.4 |
| Oracle Linux · 7 | python2-ipaclient | 0:4.6.5-11.0.1.el7_7.4 |
| Oracle Linux · 7 | python2-ipalib | 0:4.6.5-11.0.1.el7_7.4 |
| Oracle Linux · 7 | python2-ipaserver | 0:4.6.5-11.0.1.el7_7.4 |
Vulnerabilities 2
-
High 8.8
Code injection in FreeIPA
A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way the internal function ber_scanf() was used in some components of the IPA server, which parsed kerberos key data. An unaut…
-
Medium 5.7
FreeIPA logs passwords embedded in commands in calls using batch
A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way that FreeIPA's batch processing API logged operations. This included passing user passwords in clear text on FreeIPA mast…