ipa-4.3.13-1
- Resolves: RHEL-238684 Rebase ipa to latest 4.13.x version - Resolves: RHEL-238678 ipa-migrate: require Replication Administrator privilege - Resolves: RHEL-238675 ipa-epn: drop_privileges method is mixing uid and gid - Resolves: RHEL-238528 ipa env: support only simple * wildcard - Resolves: RHEL-238524 host-mod: handle the password attribute when set with --setattr userpassword= - Resolves: RHEL-238520 ipa-otptoken-import hardening - Resolves: RHEL-238515 Remove NetBIOS dependencies in Identity Manager - Resolves: RHEL-238512 WebUI Hardening - Resolves: RHEL-177835 Release Modern UI progress to RHEL 9.9 - Resolves: RHEL-240814 Unable to create users with spaces in the Last Name field in the Modern UI. - Resolves: RHEL-240813 IdM modern-ui user profile drop-down manual not responsive - Resolves: RHEL-245633 CVE-2026-19550 - Resolves: RHEL-240904 CVE-2026-13097 - Resolves: RHEL-240843 CVE-2026-11861 - Resolves: RHEL-240824 CVE-2026-73197 - Resolves: RHEL-240805 CVE-2026-73198 Signed-off-by: Rafael Guterres Jeffman <rjeffman@redhat.com>
This commit is contained in:
Rafael Guterres Jeffman
parent
4ecea3955f
commit
501628cd92
4
.gitignore
vendored
4
.gitignore
vendored
@ -131,4 +131,6 @@
|
||||
/freeipa-4.13.1.tar.gz
|
||||
/freeipa-4.13.1.tar.gz.asc
|
||||
/freeipa-4.13.2.tar.gz
|
||||
/freeipa-4.13.2.tar.gz.asc
|
||||
/freeipa-4.13.2.tar.gz.asc
|
||||
/freeipa-4.13.3.tar.gz
|
||||
/freeipa-4.13.3.tar.gz.asc
|
||||
|
||||
@ -0,0 +1,29 @@
|
||||
From bd77630753a5de7feb280f459639922fa5c3dc97 Mon Sep 17 00:00:00 2001
|
||||
From: Alexander Bokovoy <abokovoy@redhat.com>
|
||||
Date: Tue, 25 Aug 2026 10:32:25 +0300
|
||||
Subject: [PATCH] kdb: enforce CNAME comparison against ipaOriginalUid in ID
|
||||
overrides
|
||||
|
||||
Kerberos principal of an Active Directory user is stored as
|
||||
ipaOriginalUid, not `uid`. `uid` value is POSIX username.
|
||||
|
||||
Fixes: https://codeberg.org/freeipa/freeipa/issues/10041
|
||||
|
||||
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
|
||||
---
|
||||
daemons/ipa-kdb/ipa_kdb_mspac_trust.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/daemons/ipa-kdb/ipa_kdb_mspac_trust.c b/daemons/ipa-kdb/ipa_kdb_mspac_trust.c
|
||||
index f0638957b22..a09dc2dfbda 100644
|
||||
--- a/daemons/ipa-kdb/ipa_kdb_mspac_trust.c
|
||||
+++ b/daemons/ipa-kdb/ipa_kdb_mspac_trust.c
|
||||
@@ -478,7 +478,7 @@ ipadb_check_trust_view_override(krb5_context context,
|
||||
goto end;
|
||||
}
|
||||
|
||||
- uid_values = ldap_get_values_len(ipactx->lcontext, entry, "uid");
|
||||
+ uid_values = ldap_get_values_len(ipactx->lcontext, entry, "ipaOriginalUid");
|
||||
if (!uid_values || !uid_values[0]) {
|
||||
*status = "TRUST_OVERRIDE_UID_UNDEFINED";
|
||||
kerr = EINVAL;
|
||||
144
freeipa.spec
144
freeipa.spec
@ -216,7 +216,7 @@
|
||||
|
||||
# Work-around fact that RPM SPEC parser does not accept
|
||||
# "Version: @VERSION@" in freeipa.spec.in used for Autoconf string replacement
|
||||
%define IPA_VERSION 4.13.2
|
||||
%define IPA_VERSION 4.13.3
|
||||
# Release candidate version -- uncomment with one percent for RC versions
|
||||
#%%global rc_version
|
||||
%define AT_SIGN @
|
||||
@ -229,7 +229,7 @@
|
||||
|
||||
Name: %{package_name}
|
||||
Version: %{IPA_VERSION}
|
||||
Release: 2%{?rc_version:.%rc_version}%{?dist}
|
||||
Release: 1%{?rc_version:.%rc_version}%{?dist}
|
||||
Summary: The Identity, Policy and Audit system
|
||||
|
||||
License: GPL-3.0-or-later
|
||||
@ -254,6 +254,7 @@ Patch0002: 0002-Revert-custodia-do-not-use-deprecated-jwcrypto-wrapp.patch
|
||||
Patch0003: 0003-Revert-Remove-NIS-server-support.patch
|
||||
Patch0004: 0004-Change-u-to-u-for-sysusersd.patch
|
||||
Patch0006: 0006-Revert-Stop-using-deprecated-pkg_resources.patch
|
||||
Patch0007: 0007-kdb_enforce_CNAME_comparison_against_ipaOriginalUid_in_ID_overrides.patch
|
||||
Patch1001: 1001-Change-branding-to-IPA-and-Identity-Management.patch
|
||||
%endif
|
||||
%endif
|
||||
@ -595,22 +596,71 @@ Requires: system-logos-ipa >= 80.4
|
||||
# The list below is automatically generated by `fix-spec.sh -i`
|
||||
# from the install/freeipa-webui
|
||||
Provides: bundled(npm(attr-accept)) = 2.2.5
|
||||
Provides: bundled(npm(commander)) = 7.2.0
|
||||
Provides: bundled(npm(cookie)) = 1.0.2
|
||||
Provides: bundled(npm(csstype)) = 3.1.3
|
||||
Provides: bundled(npm(d3)) = 7.9.0
|
||||
Provides: bundled(npm(d3-array)) = 3.2.4
|
||||
Provides: bundled(npm(d3-axis)) = 3.0.0
|
||||
Provides: bundled(npm(d3-brush)) = 3.0.0
|
||||
Provides: bundled(npm(d3-chord)) = 3.0.1
|
||||
Provides: bundled(npm(d3-color)) = 3.1.0
|
||||
Provides: bundled(npm(d3-contour)) = 4.0.2
|
||||
Provides: bundled(npm(d3-delaunay)) = 6.0.4
|
||||
Provides: bundled(npm(d3-dispatch)) = 1.0.6
|
||||
Provides: bundled(npm(d3-dispatch)) = 3.0.1
|
||||
Provides: bundled(npm(d3-drag)) = 1.2.5
|
||||
Provides: bundled(npm(d3-drag)) = 3.0.0
|
||||
Provides: bundled(npm(d3-dsv)) = 3.0.1
|
||||
Provides: bundled(npm(d3-ease)) = 3.0.1
|
||||
Provides: bundled(npm(d3-fetch)) = 3.0.1
|
||||
Provides: bundled(npm(d3-force)) = 3.0.0
|
||||
Provides: bundled(npm(d3-format)) = 3.1.2
|
||||
Provides: bundled(npm(d3-geo)) = 3.1.1
|
||||
Provides: bundled(npm(d3-hierarchy)) = 3.1.2
|
||||
Provides: bundled(npm(d3-interpolate)) = 3.0.1
|
||||
Provides: bundled(npm(d3-path)) = 1.0.9
|
||||
Provides: bundled(npm(d3-path)) = 3.1.0
|
||||
Provides: bundled(npm(d3-polygon)) = 3.0.1
|
||||
Provides: bundled(npm(d3-quadtree)) = 3.0.1
|
||||
Provides: bundled(npm(d3-random)) = 3.0.1
|
||||
Provides: bundled(npm(d3-scale)) = 4.0.2
|
||||
Provides: bundled(npm(d3-scale-chromatic)) = 3.1.0
|
||||
Provides: bundled(npm(d3-selection)) = 1.4.2
|
||||
Provides: bundled(npm(d3-selection)) = 3.0.0
|
||||
Provides: bundled(npm(d3-shape)) = 1.3.7
|
||||
Provides: bundled(npm(d3-shape)) = 3.2.0
|
||||
Provides: bundled(npm(d3-time)) = 3.1.0
|
||||
Provides: bundled(npm(d3-time-format)) = 4.1.0
|
||||
Provides: bundled(npm(d3-timer)) = 1.0.10
|
||||
Provides: bundled(npm(d3-timer)) = 3.0.1
|
||||
Provides: bundled(npm(d3-transition)) = 3.0.1
|
||||
Provides: bundled(npm(d3-zoom)) = 3.0.0
|
||||
Provides: bundled(npm(@dagrejs/dagre)) = 1.1.2
|
||||
Provides: bundled(npm(@dagrejs/graphlib)) = 2.2.2
|
||||
Provides: bundled(npm(delaunator)) = 5.1.0
|
||||
Provides: bundled(npm(file-selector)) = 2.1.2
|
||||
Provides: bundled(npm(focus-trap)) = 7.6.4
|
||||
Provides: bundled(npm(freeipa-webui)) = 0.1.9
|
||||
Provides: bundled(npm(freeipa-webui)) = 0.2.0
|
||||
Provides: bundled(npm(iconv-lite)) = 0.6.3
|
||||
Provides: bundled(npm(immer)) = 10.1.1
|
||||
Provides: bundled(npm(internmap)) = 2.0.3
|
||||
Provides: bundled(npm(js-tokens)) = 4.0.0
|
||||
Provides: bundled(npm(lodash)) = 4.17.21
|
||||
Provides: bundled(npm(lodash)) = 4.18.1
|
||||
Provides: bundled(npm(loose-envify)) = 1.4.0
|
||||
Provides: bundled(npm(mobx)) = 6.15.0
|
||||
Provides: bundled(npm(mobx-react)) = 7.6.0
|
||||
Provides: bundled(npm(mobx-react-lite)) = 3.4.3
|
||||
Provides: bundled(npm(object-assign)) = 4.1.1
|
||||
Provides: bundled(npm(@patternfly/patternfly)) = 6.3.1
|
||||
Provides: bundled(npm(@patternfly/react-core)) = 6.3.1
|
||||
Provides: bundled(npm(@patternfly/react-icons)) = 6.3.1
|
||||
Provides: bundled(npm(@patternfly/react-styles)) = 6.3.1
|
||||
Provides: bundled(npm(@patternfly/react-table)) = 6.3.1
|
||||
Provides: bundled(npm(@patternfly/react-tokens)) = 6.3.1
|
||||
Provides: bundled(npm(@patternfly/patternfly)) = 6.4.0
|
||||
Provides: bundled(npm(@patternfly/react-core)) = 6.4.0
|
||||
Provides: bundled(npm(@patternfly/react-icons)) = 6.4.0
|
||||
Provides: bundled(npm(@patternfly/react-styles)) = 6.4.0
|
||||
Provides: bundled(npm(@patternfly/react-table)) = 6.4.0
|
||||
Provides: bundled(npm(@patternfly/react-tokens)) = 6.4.0
|
||||
Provides: bundled(npm(@patternfly/react-topology)) = 6.4.0
|
||||
Provides: bundled(npm(point-in-svg-path)) = 1.0.2
|
||||
Provides: bundled(npm(popper.js)) = 1.16.1
|
||||
Provides: bundled(npm(prop-types)) = 15.8.1
|
||||
Provides: bundled(npm(qrcode.react)) = 4.2.0
|
||||
Provides: bundled(npm(react)) = 18.3.1
|
||||
@ -618,20 +668,56 @@ Provides: bundled(npm(react-dom)) = 18.3.1
|
||||
Provides: bundled(npm(react-dropzone)) = 14.3.8
|
||||
Provides: bundled(npm(react-is)) = 16.13.1
|
||||
Provides: bundled(npm(react-redux)) = 9.2.0
|
||||
Provides: bundled(npm(react-router)) = 7.12.0
|
||||
Provides: bundled(npm(react-router)) = 7.18.1
|
||||
Provides: bundled(npm(redux)) = 5.0.1
|
||||
Provides: bundled(npm(@reduxjs/toolkit)) = 2.6.1
|
||||
Provides: bundled(npm(redux-thunk)) = 3.1.0
|
||||
Provides: bundled(npm(reselect)) = 5.1.1
|
||||
Provides: bundled(npm(robust-predicates)) = 3.0.3
|
||||
Provides: bundled(npm(rw)) = 1.3.3
|
||||
Provides: bundled(npm(safer-buffer)) = 2.1.2
|
||||
Provides: bundled(npm(scheduler)) = 0.23.2
|
||||
Provides: bundled(npm(set-cookie-parser)) = 2.7.1
|
||||
Provides: bundled(npm(tabbable)) = 6.2.0
|
||||
Provides: bundled(npm(tiny-invariant)) = 1.3.3
|
||||
Provides: bundled(npm(tslib)) = 2.8.1
|
||||
Provides: bundled(npm(@types/d3)) = 7.4.3
|
||||
Provides: bundled(npm(@types/d3-array)) = 3.2.2
|
||||
Provides: bundled(npm(@types/d3-axis)) = 3.0.6
|
||||
Provides: bundled(npm(@types/d3-brush)) = 3.0.6
|
||||
Provides: bundled(npm(@types/d3-chord)) = 3.0.6
|
||||
Provides: bundled(npm(@types/d3-color)) = 3.1.3
|
||||
Provides: bundled(npm(@types/d3-contour)) = 3.0.6
|
||||
Provides: bundled(npm(@types/d3-delaunay)) = 6.0.4
|
||||
Provides: bundled(npm(@types/d3-dispatch)) = 3.0.7
|
||||
Provides: bundled(npm(@types/d3-drag)) = 3.0.7
|
||||
Provides: bundled(npm(@types/d3-dsv)) = 3.0.7
|
||||
Provides: bundled(npm(@types/d3-ease)) = 3.0.2
|
||||
Provides: bundled(npm(@types/d3-fetch)) = 3.0.7
|
||||
Provides: bundled(npm(@types/d3-force)) = 1.2.7
|
||||
Provides: bundled(npm(@types/d3-format)) = 3.0.4
|
||||
Provides: bundled(npm(@types/d3-geo)) = 3.1.0
|
||||
Provides: bundled(npm(@types/d3-hierarchy)) = 3.1.7
|
||||
Provides: bundled(npm(@types/d3-interpolate)) = 3.0.4
|
||||
Provides: bundled(npm(@types/d3-path)) = 3.1.1
|
||||
Provides: bundled(npm(@types/d3-polygon)) = 3.0.2
|
||||
Provides: bundled(npm(@types/d3-quadtree)) = 3.0.6
|
||||
Provides: bundled(npm(@types/d3-random)) = 3.0.3
|
||||
Provides: bundled(npm(@types/d3-scale)) = 4.0.9
|
||||
Provides: bundled(npm(@types/d3-scale-chromatic)) = 3.1.0
|
||||
Provides: bundled(npm(@types/d3-selection)) = 3.0.11
|
||||
Provides: bundled(npm(@types/d3-shape)) = 3.1.8
|
||||
Provides: bundled(npm(@types/d3-time)) = 3.0.4
|
||||
Provides: bundled(npm(@types/d3-time-format)) = 4.0.3
|
||||
Provides: bundled(npm(@types/d3-timer)) = 3.0.2
|
||||
Provides: bundled(npm(@types/d3-transition)) = 3.0.9
|
||||
Provides: bundled(npm(@types/d3-zoom)) = 3.0.8
|
||||
Provides: bundled(npm(@types/geojson)) = 7946.0.16
|
||||
Provides: bundled(npm(@types/prop-types)) = 15.7.14
|
||||
Provides: bundled(npm(@types/react)) = 18.3.20
|
||||
Provides: bundled(npm(@types/use-sync-external-store)) = 0.0.6
|
||||
Provides: bundled(npm(use-sync-external-store)) = 1.5.0
|
||||
Provides: bundled(npm(webcola)) = 3.4.0
|
||||
# end of generated list
|
||||
|
||||
Provides: %{alt_name}-server-common = %{version}
|
||||
@ -1108,6 +1194,10 @@ popd
|
||||
export PATH=/usr/bin:/usr/sbin:$PATH
|
||||
|
||||
export PYTHON=%{__python3}
|
||||
%ifarch %{ix86}
|
||||
# i686 needs -latomic for ipa-getkeytab linking
|
||||
export LDFLAGS="${LDFLAGS:-%{build_ldflags}} -latomic"
|
||||
%endif
|
||||
autoreconf -ivf
|
||||
%configure --with-vendor-suffix=-%{release} \
|
||||
%{enable_server_option} \
|
||||
@ -1195,6 +1285,7 @@ rm %{buildroot}/%{plugin_dir}/libipa_modrdn.la
|
||||
rm %{buildroot}/%{plugin_dir}/libipa_lockout.la
|
||||
rm %{buildroot}/%{plugin_dir}/libipa_cldap.la
|
||||
rm %{buildroot}/%{plugin_dir}/libipa_dns.la
|
||||
rm %{buildroot}/%{plugin_dir}/libipa_krbprinc_mr.la
|
||||
rm %{buildroot}/%{plugin_dir}/libipa_sidgen.la
|
||||
rm %{buildroot}/%{plugin_dir}/libipa_sidgen_task.la
|
||||
rm %{buildroot}/%{plugin_dir}/libipa_extdom_extop.la
|
||||
@ -1550,10 +1641,8 @@ if [ -f '/etc/ssh/sshd_config' -a $restore -ge 2 ]; then
|
||||
if [ -f '/etc/ssh/sshd_config.d/04-ipa.conf' ]; then
|
||||
if ! grep -E -q '^\s*Include\s*/etc/ssh/sshd_config.d/\*\.conf' /etc/ssh/sshd_config 2> /dev/null ; then
|
||||
if ! grep -E -q '^\s*Include\s*/etc/ssh/sshd_config.d/04-ipa\.conf' /etc/ssh/sshd_config 2> /dev/null ; then
|
||||
# Include the snippet
|
||||
echo "Include /etc/ssh/sshd_config.d/04-ipa.conf" > /etc/ssh/sshd_config.ipanew
|
||||
cat /etc/ssh/sshd_config >> /etc/ssh/sshd_config.ipanew
|
||||
mv -fZ --backup=existing --suffix .ipaold /etc/ssh/sshd_config.ipanew /etc/ssh/sshd_config
|
||||
# Fix for RHEL-210656: Ensure original permissions (0600) are preserved
|
||||
sed --in-place=.ipaold '1i Include /etc/ssh/sshd_config.d/04-ipa.conf' /etc/ssh/sshd_config
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
@ -1636,6 +1725,7 @@ fi
|
||||
%attr(755,root,root) %{plugin_dir}/libipa_modrdn.so
|
||||
%attr(755,root,root) %{plugin_dir}/libipa_lockout.so
|
||||
%attr(755,root,root) %{plugin_dir}/libipa_dns.so
|
||||
%attr(755,root,root) %{plugin_dir}/libipa_krbprinc_mr.so
|
||||
%attr(755,root,root) %{plugin_dir}/libipa_range_check.so
|
||||
%attr(755,root,root) %{plugin_dir}/libipa_otp_counter.so
|
||||
%attr(755,root,root) %{plugin_dir}/libipa_otp_lasttoken.so
|
||||
@ -1968,6 +2058,24 @@ fi
|
||||
%endif
|
||||
|
||||
%changelog
|
||||
* Fri Aug 21 2026 Rafael Jeffman <rjeffman@redhat.com> - 4.13.3-1
|
||||
- Resolves: RHEL-238684 Rebase ipa to latest 4.13.x version
|
||||
- Resolves: RHEL-238678 ipa-migrate: require Replication Administrator privilege
|
||||
- Resolves: RHEL-238675 ipa-epn: drop_privileges method is mixing uid and gid
|
||||
- Resolves: RHEL-238528 ipa env: support only simple * wildcard
|
||||
- Resolves: RHEL-238524 host-mod: handle the password attribute when set with --setattr userpassword=
|
||||
- Resolves: RHEL-238520 ipa-otptoken-import hardening
|
||||
- Resolves: RHEL-238515 Remove NetBIOS dependencies in Identity Manager
|
||||
- Resolves: RHEL-238512 WebUI Hardening
|
||||
- Resolves: RHEL-177835 Release Modern UI progress to RHEL 9.9
|
||||
- Resolves: RHEL-240814 Unable to create users with spaces in the Last Name field in the Modern UI.
|
||||
- Resolves: RHEL-240813 IdM modern-ui user profile drop-down manual not responsive
|
||||
- Resolves: RHEL-245633 CVE-2026-19550
|
||||
- Resolves: RHEL-240904 CVE-2026-13097
|
||||
- Resolves: RHEL-240843 CVE-2026-11861
|
||||
- Resolves: RHEL-240824 CVE-2026-73197
|
||||
- Resolves: RHEL-240805 CVE-2026-73198
|
||||
|
||||
* Mon Aug 03 2026 Florence Blanc-Renaud <flo@redhat.com> - 4.13.2-2
|
||||
- Resolves: RHEL-222583 ipa-server-trust-ad package installation failing for samba dependency
|
||||
|
||||
@ -2024,9 +2132,9 @@ fi
|
||||
- Resolves: RHEL-137585 ipa-server-upgrade succeeds but ipactl restart fails due to ipa-dnskeysyncd service failure caused by SELinux AVC denial on RHEL 9.8
|
||||
|
||||
* Tue Dec 9 2025 Florence Blanc-Renaud <flo@redhat.com> - 4.13.0-1
|
||||
- Resolves: RHEL-134542 Add modern WebUI as submodule and enable routing in Apache
|
||||
- Resolves: RHEL-134542 Add modern WebUI as submodule and enable routing in Apache
|
||||
- Resolves: RHEL-134540 Switch IPA to use the PKI python API directly rather than RPC calls
|
||||
- Resolves: RHEL-134196 After upgrade from 9.7 to 9.8 ipactl restart fails to restart winbind service
|
||||
- Resolves: RHEL-134196 After upgrade from 9.7 to 9.8 ipactl restart fails to restart winbind service
|
||||
- Resolves: RHEL-132334 Include latest fixes in python3-ipatests package
|
||||
- Resolves: RHEL-129224 Fix ipatests for kdcproxy after CVE-2025-59088 fix
|
||||
- Resolves: RHEL-126974 Minor typo in ipa_idrange_fix.py
|
||||
@ -2038,7 +2146,7 @@ fi
|
||||
- Resolves: RHEL-73399 RFE: Update IdM password policy configurations to meet M-22-09 by restricting spaces and require number character class
|
||||
- Resolves: RHEL-128241 ATTR_NAME_BY_OID is missing OID 2.5.4.97, organizationIdentifier [rhel-9]
|
||||
- Resolves: RHEL-126514 [RFE] ipa-client-automount should have an option to include domain of the machine. [rhel-9]
|
||||
- Resolves: RHEL-124171 Include latest fixes in python3-ipatests package
|
||||
- Resolves: RHEL-124171 Include latest fixes in python3-ipatests package
|
||||
- Resolves: RHEL-120514 Include fixes in python3-ipatests [rhel-9.8]
|
||||
- Resolves: RHEL-118609 test_cacert_manage fails due to expired Let's Encrypt R3 certificate
|
||||
|
||||
|
||||
4
sources
4
sources
@ -1,2 +1,2 @@
|
||||
SHA512 (freeipa-4.13.2.tar.gz) = 11fa7de4facbfe0b0fb278114d92a9d7b7750754d9194942e8967ecaf1fff3d5a61d5f409e4a50fbc3f65a14addb8eb865a16e7361632fcaf314464c5320ba73
|
||||
SHA512 (freeipa-4.13.2.tar.gz.asc) = 5ed637e30198ab527ff74f1f5940c5409bd6395a8b91668ed01221f49e61010c709206d74863dce40b60022bdb77bd608140d6cfda7ff5eee0662fca1a604964
|
||||
SHA512 (freeipa-4.13.3.tar.gz) = 9600639b14541df5a8fecce415068aba9b18a24e5e04080e352e253777fe02142e6eaa0c85fc76dbefdd270ad823074d043661ca86eddb34a3cd0fe3d84b8574
|
||||
SHA512 (freeipa-4.13.3.tar.gz.asc) = 74819d8e5fe1350d0a77d658d41eb5066551b28ac70c2e9b32a9c231f72e3002ba06a6ea9628fd796df1b4a4154f3dc82e8d5feabeded4722dc64b51becafbed
|
||||
|
||||
Loading…
Reference in New Issue
Block a user