RHSA-2025:21820 — Red Hat Security Advisory: idm:DL1 security update

Fixed packages 98

Release	Package	Fixed in
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream	bind-dyndb-ldap	0:11.6-2.module+el8.4.0+21736+855b82c8.1
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream	bind-dyndb-ldap-debuginfo	0:11.6-2.module+el8.4.0+21736+855b82c8.1
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream	bind-dyndb-ldap-debugsource	0:11.6-2.module+el8.4.0+21736+855b82c8.1
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream	custodia	0:0.6.0-3.module+el8.1.0+4098+f286395e
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream	ipa	0:4.9.2-10.module+el8.4.0+23621+13d4146a.4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream	ipa-client	0:4.9.2-10.module+el8.4.0+23621+13d4146a.4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream	ipa-client-common	0:4.9.2-10.module+el8.4.0+23621+13d4146a.4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream	ipa-client-debuginfo	0:4.9.2-10.module+el8.4.0+23621+13d4146a.4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream	ipa-client-epn	0:4.9.2-10.module+el8.4.0+23621+13d4146a.4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream	ipa-client-samba	0:4.9.2-10.module+el8.4.0+23621+13d4146a.4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream	ipa-common	0:4.9.2-10.module+el8.4.0+23621+13d4146a.4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream	ipa-debuginfo	0:4.9.2-10.module+el8.4.0+23621+13d4146a.4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream	ipa-debugsource	0:4.9.2-10.module+el8.4.0+23621+13d4146a.4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream	ipa-healthcheck	0:0.7-3.module+el8.4.0+9007+5084bdd8
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream	ipa-healthcheck-core	0:0.7-3.module+el8.4.0+9007+5084bdd8
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream	ipa-python-compat	0:4.9.2-10.module+el8.4.0+23621+13d4146a.4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream	ipa-selinux	0:4.9.2-10.module+el8.4.0+23621+13d4146a.4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream	ipa-server	0:4.9.2-10.module+el8.4.0+23621+13d4146a.4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream	ipa-server-common	0:4.9.2-10.module+el8.4.0+23621+13d4146a.4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream	ipa-server-debuginfo	0:4.9.2-10.module+el8.4.0+23621+13d4146a.4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream	ipa-server-dns	0:4.9.2-10.module+el8.4.0+23621+13d4146a.4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream	ipa-server-trust-ad	0:4.9.2-10.module+el8.4.0+23621+13d4146a.4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream	ipa-server-trust-ad-debuginfo	0:4.9.2-10.module+el8.4.0+23621+13d4146a.4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream	opendnssec	0:2.1.7-1.module+el8.4.0+9007+5084bdd8
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream	opendnssec-debuginfo	0:2.1.7-1.module+el8.4.0+9007+5084bdd8
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream	opendnssec-debugsource	0:2.1.7-1.module+el8.4.0+9007+5084bdd8
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream	python-jwcrypto	0:0.5.0-1.module+el8.1.0+4098+f286395e
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream	python-kdcproxy	0:0.4-5.module+el8.4.0+23621+13d4146a.1
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream	python-qrcode	0:5.1-12.module+el8.1.0+4098+f286395e
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream	python-yubico	0:1.3.2-9.module+el8.1.0+4098+f286395e
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream	python3-custodia	0:0.6.0-3.module+el8.1.0+4098+f286395e
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream	python3-ipaclient	0:4.9.2-10.module+el8.4.0+23621+13d4146a.4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream	python3-ipalib	0:4.9.2-10.module+el8.4.0+23621+13d4146a.4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream	python3-ipaserver	0:4.9.2-10.module+el8.4.0+23621+13d4146a.4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream	python3-ipatests	0:4.9.2-10.module+el8.4.0+23621+13d4146a.4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream	python3-jwcrypto	0:0.5.0-1.module+el8.1.0+4098+f286395e
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream	python3-kdcproxy	0:0.4-5.module+el8.4.0+23621+13d4146a.1
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream	python3-pyusb	0:1.0.0-9.module+el8.1.0+4098+f286395e
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream	python3-qrcode	0:5.1-12.module+el8.1.0+4098+f286395e
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream	python3-qrcode-core	0:5.1-12.module+el8.1.0+4098+f286395e
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream	python3-yubico	0:1.3.2-9.module+el8.1.0+4098+f286395e
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream	pyusb	0:1.0.0-9.module+el8.1.0+4098+f286395e
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream	slapi-nis	0:0.56.6-2.1.module+el8.4.0+12579+0538eac8
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream	slapi-nis-debuginfo	0:0.56.6-2.1.module+el8.4.0+12579+0538eac8
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream	slapi-nis-debugsource	0:0.56.6-2.1.module+el8.4.0+12579+0538eac8
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream	softhsm	0:2.6.0-5.module+el8.4.0+10227+076cd560
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream	softhsm-debuginfo	0:2.6.0-5.module+el8.4.0+10227+076cd560
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream	softhsm-debugsource	0:2.6.0-5.module+el8.4.0+10227+076cd560
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream	softhsm-devel	0:2.6.0-5.module+el8.4.0+10227+076cd560
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream	bind-dyndb-ldap	0:11.6-2.module+el8.4.0+21736+855b82c8.1
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream	bind-dyndb-ldap-debuginfo	0:11.6-2.module+el8.4.0+21736+855b82c8.1
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream	bind-dyndb-ldap-debugsource	0:11.6-2.module+el8.4.0+21736+855b82c8.1
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream	custodia	0:0.6.0-3.module+el8.1.0+4098+f286395e
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream	ipa	0:4.9.2-10.module+el8.4.0+23621+13d4146a.4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream	ipa-client	0:4.9.2-10.module+el8.4.0+23621+13d4146a.4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream	ipa-client-common	0:4.9.2-10.module+el8.4.0+23621+13d4146a.4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream	ipa-client-debuginfo	0:4.9.2-10.module+el8.4.0+23621+13d4146a.4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream	ipa-client-epn	0:4.9.2-10.module+el8.4.0+23621+13d4146a.4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream	ipa-client-samba	0:4.9.2-10.module+el8.4.0+23621+13d4146a.4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream	ipa-common	0:4.9.2-10.module+el8.4.0+23621+13d4146a.4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream	ipa-debuginfo	0:4.9.2-10.module+el8.4.0+23621+13d4146a.4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream	ipa-debugsource	0:4.9.2-10.module+el8.4.0+23621+13d4146a.4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream	ipa-healthcheck	0:0.7-3.module+el8.4.0+9007+5084bdd8
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream	ipa-healthcheck-core	0:0.7-3.module+el8.4.0+9007+5084bdd8
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream	ipa-python-compat	0:4.9.2-10.module+el8.4.0+23621+13d4146a.4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream	ipa-selinux	0:4.9.2-10.module+el8.4.0+23621+13d4146a.4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream	ipa-server	0:4.9.2-10.module+el8.4.0+23621+13d4146a.4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream	ipa-server-common	0:4.9.2-10.module+el8.4.0+23621+13d4146a.4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream	ipa-server-debuginfo	0:4.9.2-10.module+el8.4.0+23621+13d4146a.4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream	ipa-server-dns	0:4.9.2-10.module+el8.4.0+23621+13d4146a.4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream	ipa-server-trust-ad	0:4.9.2-10.module+el8.4.0+23621+13d4146a.4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream	ipa-server-trust-ad-debuginfo	0:4.9.2-10.module+el8.4.0+23621+13d4146a.4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream	opendnssec	0:2.1.7-1.module+el8.4.0+9007+5084bdd8
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream	opendnssec-debuginfo	0:2.1.7-1.module+el8.4.0+9007+5084bdd8
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream	opendnssec-debugsource	0:2.1.7-1.module+el8.4.0+9007+5084bdd8
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream	python-jwcrypto	0:0.5.0-1.module+el8.1.0+4098+f286395e
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream	python-kdcproxy	0:0.4-5.module+el8.4.0+23621+13d4146a.1
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream	python-qrcode	0:5.1-12.module+el8.1.0+4098+f286395e
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream	python-yubico	0:1.3.2-9.module+el8.1.0+4098+f286395e
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream	python3-custodia	0:0.6.0-3.module+el8.1.0+4098+f286395e
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream	python3-ipaclient	0:4.9.2-10.module+el8.4.0+23621+13d4146a.4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream	python3-ipalib	0:4.9.2-10.module+el8.4.0+23621+13d4146a.4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream	python3-ipaserver	0:4.9.2-10.module+el8.4.0+23621+13d4146a.4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream	python3-ipatests	0:4.9.2-10.module+el8.4.0+23621+13d4146a.4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream	python3-jwcrypto	0:0.5.0-1.module+el8.1.0+4098+f286395e
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream	python3-kdcproxy	0:0.4-5.module+el8.4.0+23621+13d4146a.1
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream	python3-pyusb	0:1.0.0-9.module+el8.1.0+4098+f286395e
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream	python3-qrcode	0:5.1-12.module+el8.1.0+4098+f286395e
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream	python3-qrcode-core	0:5.1-12.module+el8.1.0+4098+f286395e
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream	python3-yubico	0:1.3.2-9.module+el8.1.0+4098+f286395e
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream	pyusb	0:1.0.0-9.module+el8.1.0+4098+f286395e
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream	slapi-nis	0:0.56.6-2.1.module+el8.4.0+12579+0538eac8
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream	slapi-nis-debuginfo	0:0.56.6-2.1.module+el8.4.0+12579+0538eac8
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream	slapi-nis-debugsource	0:0.56.6-2.1.module+el8.4.0+12579+0538eac8
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream	softhsm	0:2.6.0-5.module+el8.4.0+10227+076cd560
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream	softhsm-debuginfo	0:2.6.0-5.module+el8.4.0+10227+076cd560
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream	softhsm-debugsource	0:2.6.0-5.module+el8.4.0+10227+076cd560
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream	softhsm-devel	0:2.6.0-5.module+el8.4.0+10227+076cd560

Vulnerabilities 2

High 8.6

CVE-2025-59088

Python-kdcproxy: unauthenticated ssrf via realm‑controlled dns srv

If kdcproxy receives a request for a realm which does not have server addresses defined in its configuration, by default, it will query SRV records in the DNS zone matching the requested realm name. This creates a server-side request forgery vulnerability, si…

Red Hat Latchset Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Linux Debian Ubuntu Azure Linux

Nov 12, 2025
Medium 5.9

CVE-2025-59089

Python-kdcproxy: remote dos via unbounded tcp upstream buffering

If an attacker causes kdcproxy to connect to an attacker-controlled KDC server (e.g. through server-side request forgery), they can exploit the fact that kdcproxy does not enforce bounds on TCP response length to conduct a denial-of-service attack. While rece…

Red Hat Latchset Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Linux Debian Ubuntu Azure Linux

Nov 12, 2025

References

article
https://access.redhat.com/security/updates/classification/#important
report
https://bugzilla.redhat.com/show_bug.cgi?id=2393955
report
https://bugzilla.redhat.com/show_bug.cgi?id=2393958
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_21820.json
report
https://access.redhat.com/security/cve/CVE-2025-59088
advisory
https://www.cve.org/CVERecord?id=CVE-2025-59088
advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-59088
article
https://github.com/latchset/kdcproxy/pull/68
report
https://access.redhat.com/security/cve/CVE-2025-59089
advisory
https://www.cve.org/CVERecord?id=CVE-2025-59089
advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-59089
article
https://github.com/latchset/kdcproxy/commit/c7675365aa20be11f03247966336c7613cac84e1

Red Hat Security Advisory: idm:DL1 security update

Fixed packages 98

Vulnerabilities 2

Python-kdcproxy: unauthenticated ssrf via realm‑controlled dns srv

Python-kdcproxy: remote dos via unbounded tcp upstream buffering

References