From 501628cd9299a9d5a3e8de46229b2bd6fa36d14a Mon Sep 17 00:00:00 2001 From: Rafael Guterres Jeffman Date: Thu, 20 Aug 2026 14:54:17 -0300 Subject: [PATCH] ipa-4.3.13-1 - Resolves: RHEL-238684 Rebase ipa to latest 4.13.x version - Resolves: RHEL-238678 ipa-migrate: require Replication Administrator privilege - Resolves: RHEL-238675 ipa-epn: drop_privileges method is mixing uid and gid - Resolves: RHEL-238528 ipa env: support only simple * wildcard - Resolves: RHEL-238524 host-mod: handle the password attribute when set with --setattr userpassword= - Resolves: RHEL-238520 ipa-otptoken-import hardening - Resolves: RHEL-238515 Remove NetBIOS dependencies in Identity Manager - Resolves: RHEL-238512 WebUI Hardening - Resolves: RHEL-177835 Release Modern UI progress to RHEL 9.9 - Resolves: RHEL-240814 Unable to create users with spaces in the Last Name field in the Modern UI. - Resolves: RHEL-240813 IdM modern-ui user profile drop-down manual not responsive - Resolves: RHEL-245633 CVE-2026-19550 - Resolves: RHEL-240904 CVE-2026-13097 - Resolves: RHEL-240843 CVE-2026-11861 - Resolves: RHEL-240824 CVE-2026-73197 - Resolves: RHEL-240805 CVE-2026-73198 Signed-off-by: Rafael Guterres Jeffman --- .gitignore | 4 +- ...ainst_ipaOriginalUid_in_ID_overrides.patch | 29 ++++ freeipa.spec | 144 +++++++++++++++--- sources | 4 +- 4 files changed, 160 insertions(+), 21 deletions(-) create mode 100644 0007-kdb_enforce_CNAME_comparison_against_ipaOriginalUid_in_ID_overrides.patch diff --git a/.gitignore b/.gitignore index d7226bf..46d284c 100644 --- a/.gitignore +++ b/.gitignore @@ -131,4 +131,6 @@ /freeipa-4.13.1.tar.gz /freeipa-4.13.1.tar.gz.asc /freeipa-4.13.2.tar.gz -/freeipa-4.13.2.tar.gz.asc \ No newline at end of file +/freeipa-4.13.2.tar.gz.asc +/freeipa-4.13.3.tar.gz +/freeipa-4.13.3.tar.gz.asc diff --git a/0007-kdb_enforce_CNAME_comparison_against_ipaOriginalUid_in_ID_overrides.patch b/0007-kdb_enforce_CNAME_comparison_against_ipaOriginalUid_in_ID_overrides.patch new file mode 100644 index 0000000..fbfe999 --- /dev/null +++ b/0007-kdb_enforce_CNAME_comparison_against_ipaOriginalUid_in_ID_overrides.patch @@ -0,0 +1,29 @@ +From bd77630753a5de7feb280f459639922fa5c3dc97 Mon Sep 17 00:00:00 2001 +From: Alexander Bokovoy +Date: Tue, 25 Aug 2026 10:32:25 +0300 +Subject: [PATCH] kdb: enforce CNAME comparison against ipaOriginalUid in ID + overrides + +Kerberos principal of an Active Directory user is stored as +ipaOriginalUid, not `uid`. `uid` value is POSIX username. + +Fixes: https://codeberg.org/freeipa/freeipa/issues/10041 + +Signed-off-by: Alexander Bokovoy +--- + daemons/ipa-kdb/ipa_kdb_mspac_trust.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/daemons/ipa-kdb/ipa_kdb_mspac_trust.c b/daemons/ipa-kdb/ipa_kdb_mspac_trust.c +index f0638957b22..a09dc2dfbda 100644 +--- a/daemons/ipa-kdb/ipa_kdb_mspac_trust.c ++++ b/daemons/ipa-kdb/ipa_kdb_mspac_trust.c +@@ -478,7 +478,7 @@ ipadb_check_trust_view_override(krb5_context context, + goto end; + } + +- uid_values = ldap_get_values_len(ipactx->lcontext, entry, "uid"); ++ uid_values = ldap_get_values_len(ipactx->lcontext, entry, "ipaOriginalUid"); + if (!uid_values || !uid_values[0]) { + *status = "TRUST_OVERRIDE_UID_UNDEFINED"; + kerr = EINVAL; diff --git a/freeipa.spec b/freeipa.spec index 63db0db..4afab6c 100644 --- a/freeipa.spec +++ b/freeipa.spec @@ -216,7 +216,7 @@ # Work-around fact that RPM SPEC parser does not accept # "Version: @VERSION@" in freeipa.spec.in used for Autoconf string replacement -%define IPA_VERSION 4.13.2 +%define IPA_VERSION 4.13.3 # Release candidate version -- uncomment with one percent for RC versions #%%global rc_version %define AT_SIGN @ @@ -229,7 +229,7 @@ Name: %{package_name} Version: %{IPA_VERSION} -Release: 2%{?rc_version:.%rc_version}%{?dist} +Release: 1%{?rc_version:.%rc_version}%{?dist} Summary: The Identity, Policy and Audit system License: GPL-3.0-or-later @@ -254,6 +254,7 @@ Patch0002: 0002-Revert-custodia-do-not-use-deprecated-jwcrypto-wrapp.patch Patch0003: 0003-Revert-Remove-NIS-server-support.patch Patch0004: 0004-Change-u-to-u-for-sysusersd.patch Patch0006: 0006-Revert-Stop-using-deprecated-pkg_resources.patch +Patch0007: 0007-kdb_enforce_CNAME_comparison_against_ipaOriginalUid_in_ID_overrides.patch Patch1001: 1001-Change-branding-to-IPA-and-Identity-Management.patch %endif %endif @@ -595,22 +596,71 @@ Requires: system-logos-ipa >= 80.4 # The list below is automatically generated by `fix-spec.sh -i` # from the install/freeipa-webui Provides: bundled(npm(attr-accept)) = 2.2.5 +Provides: bundled(npm(commander)) = 7.2.0 Provides: bundled(npm(cookie)) = 1.0.2 Provides: bundled(npm(csstype)) = 3.1.3 +Provides: bundled(npm(d3)) = 7.9.0 +Provides: bundled(npm(d3-array)) = 3.2.4 +Provides: bundled(npm(d3-axis)) = 3.0.0 +Provides: bundled(npm(d3-brush)) = 3.0.0 +Provides: bundled(npm(d3-chord)) = 3.0.1 +Provides: bundled(npm(d3-color)) = 3.1.0 +Provides: bundled(npm(d3-contour)) = 4.0.2 +Provides: bundled(npm(d3-delaunay)) = 6.0.4 +Provides: bundled(npm(d3-dispatch)) = 1.0.6 +Provides: bundled(npm(d3-dispatch)) = 3.0.1 +Provides: bundled(npm(d3-drag)) = 1.2.5 +Provides: bundled(npm(d3-drag)) = 3.0.0 +Provides: bundled(npm(d3-dsv)) = 3.0.1 +Provides: bundled(npm(d3-ease)) = 3.0.1 +Provides: bundled(npm(d3-fetch)) = 3.0.1 +Provides: bundled(npm(d3-force)) = 3.0.0 +Provides: bundled(npm(d3-format)) = 3.1.2 +Provides: bundled(npm(d3-geo)) = 3.1.1 +Provides: bundled(npm(d3-hierarchy)) = 3.1.2 +Provides: bundled(npm(d3-interpolate)) = 3.0.1 +Provides: bundled(npm(d3-path)) = 1.0.9 +Provides: bundled(npm(d3-path)) = 3.1.0 +Provides: bundled(npm(d3-polygon)) = 3.0.1 +Provides: bundled(npm(d3-quadtree)) = 3.0.1 +Provides: bundled(npm(d3-random)) = 3.0.1 +Provides: bundled(npm(d3-scale)) = 4.0.2 +Provides: bundled(npm(d3-scale-chromatic)) = 3.1.0 +Provides: bundled(npm(d3-selection)) = 1.4.2 +Provides: bundled(npm(d3-selection)) = 3.0.0 +Provides: bundled(npm(d3-shape)) = 1.3.7 +Provides: bundled(npm(d3-shape)) = 3.2.0 +Provides: bundled(npm(d3-time)) = 3.1.0 +Provides: bundled(npm(d3-time-format)) = 4.1.0 +Provides: bundled(npm(d3-timer)) = 1.0.10 +Provides: bundled(npm(d3-timer)) = 3.0.1 +Provides: bundled(npm(d3-transition)) = 3.0.1 +Provides: bundled(npm(d3-zoom)) = 3.0.0 +Provides: bundled(npm(@dagrejs/dagre)) = 1.1.2 +Provides: bundled(npm(@dagrejs/graphlib)) = 2.2.2 +Provides: bundled(npm(delaunator)) = 5.1.0 Provides: bundled(npm(file-selector)) = 2.1.2 Provides: bundled(npm(focus-trap)) = 7.6.4 -Provides: bundled(npm(freeipa-webui)) = 0.1.9 +Provides: bundled(npm(freeipa-webui)) = 0.2.0 +Provides: bundled(npm(iconv-lite)) = 0.6.3 Provides: bundled(npm(immer)) = 10.1.1 +Provides: bundled(npm(internmap)) = 2.0.3 Provides: bundled(npm(js-tokens)) = 4.0.0 -Provides: bundled(npm(lodash)) = 4.17.21 +Provides: bundled(npm(lodash)) = 4.18.1 Provides: bundled(npm(loose-envify)) = 1.4.0 +Provides: bundled(npm(mobx)) = 6.15.0 +Provides: bundled(npm(mobx-react)) = 7.6.0 +Provides: bundled(npm(mobx-react-lite)) = 3.4.3 Provides: bundled(npm(object-assign)) = 4.1.1 -Provides: bundled(npm(@patternfly/patternfly)) = 6.3.1 -Provides: bundled(npm(@patternfly/react-core)) = 6.3.1 -Provides: bundled(npm(@patternfly/react-icons)) = 6.3.1 -Provides: bundled(npm(@patternfly/react-styles)) = 6.3.1 -Provides: bundled(npm(@patternfly/react-table)) = 6.3.1 -Provides: bundled(npm(@patternfly/react-tokens)) = 6.3.1 +Provides: bundled(npm(@patternfly/patternfly)) = 6.4.0 +Provides: bundled(npm(@patternfly/react-core)) = 6.4.0 +Provides: bundled(npm(@patternfly/react-icons)) = 6.4.0 +Provides: bundled(npm(@patternfly/react-styles)) = 6.4.0 +Provides: bundled(npm(@patternfly/react-table)) = 6.4.0 +Provides: bundled(npm(@patternfly/react-tokens)) = 6.4.0 +Provides: bundled(npm(@patternfly/react-topology)) = 6.4.0 +Provides: bundled(npm(point-in-svg-path)) = 1.0.2 +Provides: bundled(npm(popper.js)) = 1.16.1 Provides: bundled(npm(prop-types)) = 15.8.1 Provides: bundled(npm(qrcode.react)) = 4.2.0 Provides: bundled(npm(react)) = 18.3.1 @@ -618,20 +668,56 @@ Provides: bundled(npm(react-dom)) = 18.3.1 Provides: bundled(npm(react-dropzone)) = 14.3.8 Provides: bundled(npm(react-is)) = 16.13.1 Provides: bundled(npm(react-redux)) = 9.2.0 -Provides: bundled(npm(react-router)) = 7.12.0 +Provides: bundled(npm(react-router)) = 7.18.1 Provides: bundled(npm(redux)) = 5.0.1 Provides: bundled(npm(@reduxjs/toolkit)) = 2.6.1 Provides: bundled(npm(redux-thunk)) = 3.1.0 Provides: bundled(npm(reselect)) = 5.1.1 +Provides: bundled(npm(robust-predicates)) = 3.0.3 +Provides: bundled(npm(rw)) = 1.3.3 +Provides: bundled(npm(safer-buffer)) = 2.1.2 Provides: bundled(npm(scheduler)) = 0.23.2 Provides: bundled(npm(set-cookie-parser)) = 2.7.1 Provides: bundled(npm(tabbable)) = 6.2.0 Provides: bundled(npm(tiny-invariant)) = 1.3.3 Provides: bundled(npm(tslib)) = 2.8.1 +Provides: bundled(npm(@types/d3)) = 7.4.3 +Provides: bundled(npm(@types/d3-array)) = 3.2.2 +Provides: bundled(npm(@types/d3-axis)) = 3.0.6 +Provides: bundled(npm(@types/d3-brush)) = 3.0.6 +Provides: bundled(npm(@types/d3-chord)) = 3.0.6 +Provides: bundled(npm(@types/d3-color)) = 3.1.3 +Provides: bundled(npm(@types/d3-contour)) = 3.0.6 +Provides: bundled(npm(@types/d3-delaunay)) = 6.0.4 +Provides: bundled(npm(@types/d3-dispatch)) = 3.0.7 +Provides: bundled(npm(@types/d3-drag)) = 3.0.7 +Provides: bundled(npm(@types/d3-dsv)) = 3.0.7 +Provides: bundled(npm(@types/d3-ease)) = 3.0.2 +Provides: bundled(npm(@types/d3-fetch)) = 3.0.7 +Provides: bundled(npm(@types/d3-force)) = 1.2.7 +Provides: bundled(npm(@types/d3-format)) = 3.0.4 +Provides: bundled(npm(@types/d3-geo)) = 3.1.0 +Provides: bundled(npm(@types/d3-hierarchy)) = 3.1.7 +Provides: bundled(npm(@types/d3-interpolate)) = 3.0.4 +Provides: bundled(npm(@types/d3-path)) = 3.1.1 +Provides: bundled(npm(@types/d3-polygon)) = 3.0.2 +Provides: bundled(npm(@types/d3-quadtree)) = 3.0.6 +Provides: bundled(npm(@types/d3-random)) = 3.0.3 +Provides: bundled(npm(@types/d3-scale)) = 4.0.9 +Provides: bundled(npm(@types/d3-scale-chromatic)) = 3.1.0 +Provides: bundled(npm(@types/d3-selection)) = 3.0.11 +Provides: bundled(npm(@types/d3-shape)) = 3.1.8 +Provides: bundled(npm(@types/d3-time)) = 3.0.4 +Provides: bundled(npm(@types/d3-time-format)) = 4.0.3 +Provides: bundled(npm(@types/d3-timer)) = 3.0.2 +Provides: bundled(npm(@types/d3-transition)) = 3.0.9 +Provides: bundled(npm(@types/d3-zoom)) = 3.0.8 +Provides: bundled(npm(@types/geojson)) = 7946.0.16 Provides: bundled(npm(@types/prop-types)) = 15.7.14 Provides: bundled(npm(@types/react)) = 18.3.20 Provides: bundled(npm(@types/use-sync-external-store)) = 0.0.6 Provides: bundled(npm(use-sync-external-store)) = 1.5.0 +Provides: bundled(npm(webcola)) = 3.4.0 # end of generated list Provides: %{alt_name}-server-common = %{version} @@ -1108,6 +1194,10 @@ popd export PATH=/usr/bin:/usr/sbin:$PATH export PYTHON=%{__python3} +%ifarch %{ix86} +# i686 needs -latomic for ipa-getkeytab linking +export LDFLAGS="${LDFLAGS:-%{build_ldflags}} -latomic" +%endif autoreconf -ivf %configure --with-vendor-suffix=-%{release} \ %{enable_server_option} \ @@ -1195,6 +1285,7 @@ rm %{buildroot}/%{plugin_dir}/libipa_modrdn.la rm %{buildroot}/%{plugin_dir}/libipa_lockout.la rm %{buildroot}/%{plugin_dir}/libipa_cldap.la rm %{buildroot}/%{plugin_dir}/libipa_dns.la +rm %{buildroot}/%{plugin_dir}/libipa_krbprinc_mr.la rm %{buildroot}/%{plugin_dir}/libipa_sidgen.la rm %{buildroot}/%{plugin_dir}/libipa_sidgen_task.la rm %{buildroot}/%{plugin_dir}/libipa_extdom_extop.la @@ -1550,10 +1641,8 @@ if [ -f '/etc/ssh/sshd_config' -a $restore -ge 2 ]; then if [ -f '/etc/ssh/sshd_config.d/04-ipa.conf' ]; then if ! grep -E -q '^\s*Include\s*/etc/ssh/sshd_config.d/\*\.conf' /etc/ssh/sshd_config 2> /dev/null ; then if ! grep -E -q '^\s*Include\s*/etc/ssh/sshd_config.d/04-ipa\.conf' /etc/ssh/sshd_config 2> /dev/null ; then - # Include the snippet - echo "Include /etc/ssh/sshd_config.d/04-ipa.conf" > /etc/ssh/sshd_config.ipanew - cat /etc/ssh/sshd_config >> /etc/ssh/sshd_config.ipanew - mv -fZ --backup=existing --suffix .ipaold /etc/ssh/sshd_config.ipanew /etc/ssh/sshd_config + # Fix for RHEL-210656: Ensure original permissions (0600) are preserved + sed --in-place=.ipaold '1i Include /etc/ssh/sshd_config.d/04-ipa.conf' /etc/ssh/sshd_config fi fi fi @@ -1636,6 +1725,7 @@ fi %attr(755,root,root) %{plugin_dir}/libipa_modrdn.so %attr(755,root,root) %{plugin_dir}/libipa_lockout.so %attr(755,root,root) %{plugin_dir}/libipa_dns.so +%attr(755,root,root) %{plugin_dir}/libipa_krbprinc_mr.so %attr(755,root,root) %{plugin_dir}/libipa_range_check.so %attr(755,root,root) %{plugin_dir}/libipa_otp_counter.so %attr(755,root,root) %{plugin_dir}/libipa_otp_lasttoken.so @@ -1968,6 +2058,24 @@ fi %endif %changelog +* Fri Aug 21 2026 Rafael Jeffman - 4.13.3-1 +- Resolves: RHEL-238684 Rebase ipa to latest 4.13.x version +- Resolves: RHEL-238678 ipa-migrate: require Replication Administrator privilege +- Resolves: RHEL-238675 ipa-epn: drop_privileges method is mixing uid and gid +- Resolves: RHEL-238528 ipa env: support only simple * wildcard +- Resolves: RHEL-238524 host-mod: handle the password attribute when set with --setattr userpassword= +- Resolves: RHEL-238520 ipa-otptoken-import hardening +- Resolves: RHEL-238515 Remove NetBIOS dependencies in Identity Manager +- Resolves: RHEL-238512 WebUI Hardening +- Resolves: RHEL-177835 Release Modern UI progress to RHEL 9.9 +- Resolves: RHEL-240814 Unable to create users with spaces in the Last Name field in the Modern UI. +- Resolves: RHEL-240813 IdM modern-ui user profile drop-down manual not responsive +- Resolves: RHEL-245633 CVE-2026-19550 +- Resolves: RHEL-240904 CVE-2026-13097 +- Resolves: RHEL-240843 CVE-2026-11861 +- Resolves: RHEL-240824 CVE-2026-73197 +- Resolves: RHEL-240805 CVE-2026-73198 + * Mon Aug 03 2026 Florence Blanc-Renaud - 4.13.2-2 - Resolves: RHEL-222583 ipa-server-trust-ad package installation failing for samba dependency @@ -2024,9 +2132,9 @@ fi - Resolves: RHEL-137585 ipa-server-upgrade succeeds but ipactl restart fails due to ipa-dnskeysyncd service failure caused by SELinux AVC denial on RHEL 9.8 * Tue Dec 9 2025 Florence Blanc-Renaud - 4.13.0-1 -- Resolves: RHEL-134542 Add modern WebUI as submodule and enable routing in Apache +- Resolves: RHEL-134542 Add modern WebUI as submodule and enable routing in Apache - Resolves: RHEL-134540 Switch IPA to use the PKI python API directly rather than RPC calls -- Resolves: RHEL-134196 After upgrade from 9.7 to 9.8 ipactl restart fails to restart winbind service +- Resolves: RHEL-134196 After upgrade from 9.7 to 9.8 ipactl restart fails to restart winbind service - Resolves: RHEL-132334 Include latest fixes in python3-ipatests package - Resolves: RHEL-129224 Fix ipatests for kdcproxy after CVE-2025-59088 fix - Resolves: RHEL-126974 Minor typo in ipa_idrange_fix.py @@ -2038,7 +2146,7 @@ fi - Resolves: RHEL-73399 RFE: Update IdM password policy configurations to meet M-22-09 by restricting spaces and require number character class - Resolves: RHEL-128241 ATTR_NAME_BY_OID is missing OID 2.5.4.97, organizationIdentifier [rhel-9] - Resolves: RHEL-126514 [RFE] ipa-client-automount should have an option to include domain of the machine. [rhel-9] -- Resolves: RHEL-124171 Include latest fixes in python3-ipatests package +- Resolves: RHEL-124171 Include latest fixes in python3-ipatests package - Resolves: RHEL-120514 Include fixes in python3-ipatests [rhel-9.8] - Resolves: RHEL-118609 test_cacert_manage fails due to expired Let's Encrypt R3 certificate diff --git a/sources b/sources index 029125a..da806eb 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (freeipa-4.13.2.tar.gz) = 11fa7de4facbfe0b0fb278114d92a9d7b7750754d9194942e8967ecaf1fff3d5a61d5f409e4a50fbc3f65a14addb8eb865a16e7361632fcaf314464c5320ba73 -SHA512 (freeipa-4.13.2.tar.gz.asc) = 5ed637e30198ab527ff74f1f5940c5409bd6395a8b91668ed01221f49e61010c709206d74863dce40b60022bdb77bd608140d6cfda7ff5eee0662fca1a604964 +SHA512 (freeipa-4.13.3.tar.gz) = 9600639b14541df5a8fecce415068aba9b18a24e5e04080e352e253777fe02142e6eaa0c85fc76dbefdd270ad823074d043661ca86eddb34a3cd0fe3d84b8574 +SHA512 (freeipa-4.13.3.tar.gz.asc) = 74819d8e5fe1350d0a77d658d41eb5066551b28ac70c2e9b32a9c231f72e3002ba06a6ea9628fd796df1b4a4154f3dc82e8d5feabeded4722dc64b51becafbed