Summary
bind-dyndb-ldap
custodia
ipa
[4.9.13-10.0.1]
- Set IPAPLATFORM=rhel when build on Oracle Linux [Orabug: 29516674]
[4.9.13-10]
- kdb: apply combinatorial logic for ticket flags (CVE-2024-3183)
Resolves: RHEL-29927
- kdb: fix vulnerability in GCD rules handling (CVE-2024-2698)
Resolves: RHEL-29692
ipa-healthcheck
opendnssec
python-jwcrypto
python-kdcproxy
python-qrcode
python-yubico
pyusb
slapi-nis
softhsm
Fixed packages 30
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | bind-dyndb-ldap | 0:11.6-5.module+el8.10.0+90339+985471f7 |
| Oracle Linux · 8 | custodia | 0:0.6.0-3.module+el8.9.0+90094+20819f5a |
| Oracle Linux · 8 | ipa-client | 0:4.9.13-10.0.1.module+el8.10.0+90350+f6ece971 |
| Oracle Linux · 8 | ipa-client-common | 0:4.9.13-10.0.1.module+el8.10.0+90350+f6ece971 |
| Oracle Linux · 8 | ipa-client-epn | 0:4.9.13-10.0.1.module+el8.10.0+90350+f6ece971 |
| Oracle Linux · 8 | ipa-client-samba | 0:4.9.13-10.0.1.module+el8.10.0+90350+f6ece971 |
| Oracle Linux · 8 | ipa-common | 0:4.9.13-10.0.1.module+el8.10.0+90350+f6ece971 |
| Oracle Linux · 8 | ipa-healthcheck | 0:0.12-3.module+el8.9.0+90094+20819f5a |
| Oracle Linux · 8 | ipa-healthcheck-core | 0:0.12-3.module+el8.9.0+90094+20819f5a |
| Oracle Linux · 8 | ipa-python-compat | 0:4.9.13-10.0.1.module+el8.10.0+90350+f6ece971 |
| Oracle Linux · 8 | ipa-selinux | 0:4.9.13-10.0.1.module+el8.10.0+90350+f6ece971 |
| Oracle Linux · 8 | ipa-server | 0:4.9.13-10.0.1.module+el8.10.0+90350+f6ece971 |
| Oracle Linux · 8 | ipa-server-common | 0:4.9.13-10.0.1.module+el8.10.0+90350+f6ece971 |
| Oracle Linux · 8 | ipa-server-dns | 0:4.9.13-10.0.1.module+el8.10.0+90350+f6ece971 |
| Oracle Linux · 8 | ipa-server-trust-ad | 0:4.9.13-10.0.1.module+el8.10.0+90350+f6ece971 |
| Oracle Linux · 8 | opendnssec | 0:2.1.7-1.module+el8.9.0+90094+20819f5a |
| Oracle Linux · 8 | python3-custodia | 0:0.6.0-3.module+el8.9.0+90094+20819f5a |
| Oracle Linux · 8 | python3-ipaclient | 0:4.9.13-10.0.1.module+el8.10.0+90350+f6ece971 |
| Oracle Linux · 8 | python3-ipalib | 0:4.9.13-10.0.1.module+el8.10.0+90350+f6ece971 |
| Oracle Linux · 8 | python3-ipaserver | 0:4.9.13-10.0.1.module+el8.10.0+90350+f6ece971 |
| Oracle Linux · 8 | python3-ipatests | 0:4.9.13-10.0.1.module+el8.10.0+90350+f6ece971 |
| Oracle Linux · 8 | python3-jwcrypto | 0:0.5.0-2.module+el8.10.0+90339+985471f7 |
| Oracle Linux · 8 | python3-kdcproxy | 0:0.4-5.module+el8.9.0+90122+3305dc1d |
| Oracle Linux · 8 | python3-pyusb | 0:1.0.0-9.1.module+el8.9.0+90094+20819f5a |
| Oracle Linux · 8 | python3-qrcode | 0:5.1-12.module+el8.9.0+90094+20819f5a |
| Oracle Linux · 8 | python3-qrcode-core | 0:5.1-12.module+el8.9.0+90094+20819f5a |
| Oracle Linux · 8 | python3-yubico | 0:1.3.2-9.1.module+el8.9.0+90094+20819f5a |
| Oracle Linux · 8 | slapi-nis | 0:0.60.0-4.module+el8.10.0+90297+bfe93ccc |
| Oracle Linux · 8 | softhsm | 0:2.6.0-5.module+el8.9.0+90094+20819f5a |
| Oracle Linux · 8 | softhsm-devel | 0:2.6.0-5.module+el8.9.0+90094+20819f5a |
Vulnerabilities 2
-
High 8.8
Freeipa: delegation rules allow a proxy service to impersonate any user to access another target service
A vulnerability was found in FreeIPA in how the initial implementation of MS-SFU by MIT Kerberos was missing a condition for granting the "forwardable" flag on S4U2Self tickets. Fixing this mistake required adding a special case for the check_allowed_to_deleg…
-
High 8.1CVE-2024-3183 Public exploit
Freeipa: user can obtain a hash of the passwords of all domain users and perform offline brute force
A vulnerability was found in FreeIPA in a way when a Kerberos TGS-REQ is encrypted using the client’s session key. This key is different for each new session, which protects it from brute force attacks. However, the ticket it contains is encrypted using the t…