Fixed packages 98
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream | bind-dyndb-ldap | 0:11.6-4.module+el8.8.0+21675+157fa23b.2 |
| Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream | bind-dyndb-ldap-debuginfo | 0:11.6-4.module+el8.8.0+21675+157fa23b.2 |
| Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream | bind-dyndb-ldap-debugsource | 0:11.6-4.module+el8.8.0+21675+157fa23b.2 |
| Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream | custodia | 0:0.6.0-3.module+el8.1.0+4098+f286395e |
| Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream | ipa | 0:4.9.11-11.module+el8.8.0+25045+e21657cc.6 |
| Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream | ipa-client | 0:4.9.11-11.module+el8.8.0+25045+e21657cc.6 |
| Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream | ipa-client-common | 0:4.9.11-11.module+el8.8.0+25045+e21657cc.6 |
| Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream | ipa-client-debuginfo | 0:4.9.11-11.module+el8.8.0+25045+e21657cc.6 |
| Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream | ipa-client-epn | 0:4.9.11-11.module+el8.8.0+25045+e21657cc.6 |
| Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream | ipa-client-samba | 0:4.9.11-11.module+el8.8.0+25045+e21657cc.6 |
| Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream | ipa-common | 0:4.9.11-11.module+el8.8.0+25045+e21657cc.6 |
| Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream | ipa-debuginfo | 0:4.9.11-11.module+el8.8.0+25045+e21657cc.6 |
| Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream | ipa-debugsource | 0:4.9.11-11.module+el8.8.0+25045+e21657cc.6 |
| Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream | ipa-healthcheck | 0:0.12-1.module+el8.8.0+17583+8c783c60 |
| Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream | ipa-healthcheck-core | 0:0.12-1.module+el8.8.0+17583+8c783c60 |
| Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream | ipa-python-compat | 0:4.9.11-11.module+el8.8.0+25045+e21657cc.6 |
| Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream | ipa-selinux | 0:4.9.11-11.module+el8.8.0+25045+e21657cc.6 |
| Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream | ipa-server | 0:4.9.11-11.module+el8.8.0+25043+cab6964c.6 |
| Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream | ipa-server-common | 0:4.9.11-11.module+el8.8.0+25043+cab6964c.6 |
| Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream | ipa-server-debuginfo | 0:4.9.11-11.module+el8.8.0+25043+cab6964c.6 |
| Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream | ipa-server-dns | 0:4.9.11-11.module+el8.8.0+25043+cab6964c.6 |
| Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream | ipa-server-trust-ad | 0:4.9.11-11.module+el8.8.0+25043+cab6964c.6 |
| Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream | ipa-server-trust-ad-debuginfo | 0:4.9.11-11.module+el8.8.0+25043+cab6964c.6 |
| Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream | opendnssec | 0:2.1.7-1.module+el8.4.0+9007+5084bdd8 |
| Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream | opendnssec-debuginfo | 0:2.1.7-1.module+el8.4.0+9007+5084bdd8 |
| Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream | opendnssec-debugsource | 0:2.1.7-1.module+el8.4.0+9007+5084bdd8 |
| Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream | python-jwcrypto | 0:0.5.0-1.1.module+el8.7.0+15888+685a878f |
| Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream | python-kdcproxy | 0:0.4-5.module+el8.8.0+24989+289c67e6.1 |
| Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream | python-qrcode | 0:5.1-12.module+el8.1.0+4107+4a66eb87 |
| Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream | python-yubico | 0:1.3.2-9.1.module+el8.7.0+15691+2b2c1dd5 |
| Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream | python3-custodia | 0:0.6.0-3.module+el8.1.0+4098+f286395e |
| Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream | python3-ipaclient | 0:4.9.11-11.module+el8.8.0+25045+e21657cc.6 |
| Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream | python3-ipalib | 0:4.9.11-11.module+el8.8.0+25045+e21657cc.6 |
| Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream | python3-ipaserver | 0:4.9.11-11.module+el8.8.0+25043+cab6964c.6 |
| Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream | python3-ipatests | 0:4.9.11-11.module+el8.8.0+25043+cab6964c.6 |
| Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream | python3-jwcrypto | 0:0.5.0-1.1.module+el8.7.0+15888+685a878f |
| Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream | python3-kdcproxy | 0:0.4-5.module+el8.8.0+24989+289c67e6.1 |
| Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream | python3-pyusb | 0:1.0.0-9.1.module+el8.7.0+15691+2b2c1dd5 |
| Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream | python3-qrcode | 0:5.1-12.module+el8.1.0+4107+4a66eb87 |
| Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream | python3-qrcode-core | 0:5.1-12.module+el8.1.0+4107+4a66eb87 |
| Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream | python3-yubico | 0:1.3.2-9.1.module+el8.7.0+15691+2b2c1dd5 |
| Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream | pyusb | 0:1.0.0-9.1.module+el8.7.0+15691+2b2c1dd5 |
| Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream | slapi-nis | 0:0.60.0-4.module+el8.8.0+20635+330e3683 |
| Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream | slapi-nis-debuginfo | 0:0.60.0-4.module+el8.8.0+20635+330e3683 |
| Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream | slapi-nis-debugsource | 0:0.60.0-4.module+el8.8.0+20635+330e3683 |
| Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream | softhsm | 0:2.6.0-5.module+el8.4.0+10227+076cd560 |
| Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream | softhsm-debuginfo | 0:2.6.0-5.module+el8.4.0+10227+076cd560 |
| Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream | softhsm-debugsource | 0:2.6.0-5.module+el8.4.0+10227+076cd560 |
| Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream | softhsm-devel | 0:2.6.0-5.module+el8.4.0+10227+076cd560 |
| Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream | bind-dyndb-ldap | 0:11.6-4.module+el8.8.0+21675+157fa23b.2 |
| Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream | bind-dyndb-ldap-debuginfo | 0:11.6-4.module+el8.8.0+21675+157fa23b.2 |
| Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream | bind-dyndb-ldap-debugsource | 0:11.6-4.module+el8.8.0+21675+157fa23b.2 |
| Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream | custodia | 0:0.6.0-3.module+el8.1.0+4098+f286395e |
| Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream | ipa | 0:4.9.11-11.module+el8.8.0+25045+e21657cc.6 |
| Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream | ipa-client | 0:4.9.11-11.module+el8.8.0+25045+e21657cc.6 |
| Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream | ipa-client-common | 0:4.9.11-11.module+el8.8.0+25045+e21657cc.6 |
| Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream | ipa-client-debuginfo | 0:4.9.11-11.module+el8.8.0+25045+e21657cc.6 |
| Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream | ipa-client-epn | 0:4.9.11-11.module+el8.8.0+25045+e21657cc.6 |
| Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream | ipa-client-samba | 0:4.9.11-11.module+el8.8.0+25045+e21657cc.6 |
| Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream | ipa-common | 0:4.9.11-11.module+el8.8.0+25045+e21657cc.6 |
| Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream | ipa-debuginfo | 0:4.9.11-11.module+el8.8.0+25045+e21657cc.6 |
| Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream | ipa-debugsource | 0:4.9.11-11.module+el8.8.0+25045+e21657cc.6 |
| Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream | ipa-healthcheck | 0:0.12-1.module+el8.8.0+17583+8c783c60 |
| Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream | ipa-healthcheck-core | 0:0.12-1.module+el8.8.0+17583+8c783c60 |
| Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream | ipa-python-compat | 0:4.9.11-11.module+el8.8.0+25045+e21657cc.6 |
| Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream | ipa-selinux | 0:4.9.11-11.module+el8.8.0+25045+e21657cc.6 |
| Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream | ipa-server | 0:4.9.11-11.module+el8.8.0+25043+cab6964c.6 |
| Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream | ipa-server-common | 0:4.9.11-11.module+el8.8.0+25043+cab6964c.6 |
| Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream | ipa-server-debuginfo | 0:4.9.11-11.module+el8.8.0+25043+cab6964c.6 |
| Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream | ipa-server-dns | 0:4.9.11-11.module+el8.8.0+25043+cab6964c.6 |
| Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream | ipa-server-trust-ad | 0:4.9.11-11.module+el8.8.0+25043+cab6964c.6 |
| Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream | ipa-server-trust-ad-debuginfo | 0:4.9.11-11.module+el8.8.0+25043+cab6964c.6 |
| Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream | opendnssec | 0:2.1.7-1.module+el8.4.0+9007+5084bdd8 |
| Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream | opendnssec-debuginfo | 0:2.1.7-1.module+el8.4.0+9007+5084bdd8 |
| Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream | opendnssec-debugsource | 0:2.1.7-1.module+el8.4.0+9007+5084bdd8 |
| Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream | python-jwcrypto | 0:0.5.0-1.1.module+el8.7.0+15888+685a878f |
| Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream | python-kdcproxy | 0:0.4-5.module+el8.8.0+24989+289c67e6.1 |
| Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream | python-qrcode | 0:5.1-12.module+el8.1.0+4107+4a66eb87 |
| Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream | python-yubico | 0:1.3.2-9.1.module+el8.7.0+15691+2b2c1dd5 |
| Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream | python3-custodia | 0:0.6.0-3.module+el8.1.0+4098+f286395e |
| Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream | python3-ipaclient | 0:4.9.11-11.module+el8.8.0+25045+e21657cc.6 |
| Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream | python3-ipalib | 0:4.9.11-11.module+el8.8.0+25045+e21657cc.6 |
| Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream | python3-ipaserver | 0:4.9.11-11.module+el8.8.0+25043+cab6964c.6 |
| Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream | python3-ipatests | 0:4.9.11-11.module+el8.8.0+25043+cab6964c.6 |
| Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream | python3-jwcrypto | 0:0.5.0-1.1.module+el8.7.0+15888+685a878f |
| Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream | python3-kdcproxy | 0:0.4-5.module+el8.8.0+24989+289c67e6.1 |
| Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream | python3-pyusb | 0:1.0.0-9.1.module+el8.7.0+15691+2b2c1dd5 |
| Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream | python3-qrcode | 0:5.1-12.module+el8.1.0+4107+4a66eb87 |
| Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream | python3-qrcode-core | 0:5.1-12.module+el8.1.0+4107+4a66eb87 |
| Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream | python3-yubico | 0:1.3.2-9.1.module+el8.7.0+15691+2b2c1dd5 |
| Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream | pyusb | 0:1.0.0-9.1.module+el8.7.0+15691+2b2c1dd5 |
| Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream | slapi-nis | 0:0.60.0-4.module+el8.8.0+20635+330e3683 |
| Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream | slapi-nis-debuginfo | 0:0.60.0-4.module+el8.8.0+20635+330e3683 |
| Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream | slapi-nis-debugsource | 0:0.60.0-4.module+el8.8.0+20635+330e3683 |
| Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream | softhsm | 0:2.6.0-5.module+el8.4.0+10227+076cd560 |
| Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream | softhsm-debuginfo | 0:2.6.0-5.module+el8.4.0+10227+076cd560 |
| Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream | softhsm-debugsource | 0:2.6.0-5.module+el8.4.0+10227+076cd560 |
| Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream | softhsm-devel | 0:2.6.0-5.module+el8.4.0+10227+076cd560 |
Vulnerabilities 8
-
Critical 9.8CVE-2026-76578 Public exploit
Ipa: freeipa: freeipa: unauthenticated ldap client can obtain administrator credentials via the self-managed-token aci
A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the und…
-
Critical 9.6
Freeipa: idm: ipa: freeipa: obtaining tgs with impersonating cname through trust relationships
A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by imperso…
-
High 8.7
Ipa: privilege escalation via krbcanonicalname manipulation due to realm-unaware uniqueness enforcement in freeipa ldap datastore
A privilege escalation flaw was found in FreeIPA. The uniqueness constraint enforced on Kerberos principal name attributes in the 389-ds directory server does not properly account for equivalent representations of the same principal name, allowing a user with…
-
High 8.2
Freeipa: ipa: freeipa: trust-fetch-domains uses trust-read aci to gate a privileged ad trust refresh, allowing unauthorized ldap writes
A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trus…
-
High 8.1
Freeipa: ipa: freeipa/idm: cross-site scripting vulnerability allows arbitrary code execution via crafted url
A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting (XSS) vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, t…
-
High 8.1
Freeipa: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service
A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval() call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regard…
-
High 7.5
Ipa: freeipa: unauthenticated dos in `/ipa/migration/migration.py` via unbounded request body read
A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the `/ipa/migration/migration.py` endpoint. This can force the migration handler to read attacker-controlled request bodi…
-
High 7.5
Ipa: freeipa: unauthenticated dos in `/ipa/i18n_messages` via unbounded request body read
A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit a vulnerability in the `/ipa/i18n_messages` endpoint by sending an arbitrarily large request body. This can cause the service to consume excessive memory, leading to memory exhaustion…
References
-
article
https://access.redhat.com/security/updates/classification/#critical
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2472960
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2474697
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2487472
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2508181
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2514019
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2515974
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2519522
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2523356
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_83461.json
-
report
https://access.redhat.com/security/cve/CVE-2026-11861
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-11861
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-11861
-
report
https://access.redhat.com/security/cve/CVE-2026-13097
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-13097
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-13097
-
report
https://access.redhat.com/security/cve/CVE-2026-18147
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-18147
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-18147
-
report
https://access.redhat.com/security/cve/CVE-2026-19550
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-19550
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-19550
-
report
https://access.redhat.com/security/cve/CVE-2026-73197
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-73197
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-73197
-
report
https://access.redhat.com/security/cve/CVE-2026-73198
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-73198
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-73198
-
report
https://access.redhat.com/security/cve/CVE-2026-76578
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-76578
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-76578
-
report
https://access.redhat.com/security/cve/CVE-2026-79678
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-79678
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-79678