Summary
[4.6.8-5.0.1]
- Blank out header-logo.png product-name.png
- Replace login-screen-logo.png [Orabug: 20362818]
[4.6.8-5.el7_9.16]
- Resolves: RHEL-12570 ipa: Invalid CSRF protection
Fixed packages 11
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | ipa-client | 0:4.6.8-5.0.1.el7_9.16 |
| Oracle Linux · 7 | ipa-client-common | 0:4.6.8-5.0.1.el7_9.16 |
| Oracle Linux · 7 | ipa-common | 0:4.6.8-5.0.1.el7_9.16 |
| Oracle Linux · 7 | ipa-python-compat | 0:4.6.8-5.0.1.el7_9.16 |
| Oracle Linux · 7 | ipa-server | 0:4.6.8-5.0.1.el7_9.16 |
| Oracle Linux · 7 | ipa-server-common | 0:4.6.8-5.0.1.el7_9.16 |
| Oracle Linux · 7 | ipa-server-dns | 0:4.6.8-5.0.1.el7_9.16 |
| Oracle Linux · 7 | ipa-server-trust-ad | 0:4.6.8-5.0.1.el7_9.16 |
| Oracle Linux · 7 | python2-ipaclient | 0:4.6.8-5.0.1.el7_9.16 |
| Oracle Linux · 7 | python2-ipalib | 0:4.6.8-5.0.1.el7_9.16 |
| Oracle Linux · 7 | python2-ipaserver | 0:4.6.8-5.0.1.el7_9.16 |
Vulnerabilities 1
-
Medium 6.5
Ipa: invalid csrf protection
A Cross-site request forgery vulnerability exists in ipa/session/login_password in all supported versions of IPA. This flaw allows an attacker to trick the user into submitting a request that could perform actions as the user, resulting in a loss of confident…