RHBA-2011:1529 - Bug Fix Advisory

Topic

Updated sssd packages that fix multiple bugs and add one enhancement are now
available for Red Hat Enterprise Linux 6.

Description

The sssd packages contain a set of daemons to manage access to remote
directories and authentication mechanisms.

These updated sssd packages include numerous bug fixes and one enhancement.
Space precludes documenting all of these changes in this advisory. Users are
directed to the Red Hat Enterprise Linux 6.2 Technical Notes for information on
the most significant of these changes:

https://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/6.2_Technical_Notes/sssd.html#RHBA-2011-1529

All users of SSSD should upgrade to these updated packages, which fix these bugs
and add this enhancement.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 6 s390x

Fixes

• BZ - 677327 - [RFE] Support overriding attribute value
• BZ - 692090 - SSSD is not populating nested groups in Active Directory
• BZ - 692404 - rfc2307bis groups are being enumerated even when the gidNumber is out of the range of min_id,max_id.
• BZ - 698723 - kpasswd fails when using sssd and kadmin server != kdc server
• BZ - 699530 - Users with a local group as their primary GID are denied access by the simple access provider
• BZ - 700172 - RFE: SSSD should support paged LDAP lookups
• BZ - 700828 - Process /usr/libexec/sssd/sssd_be was killed by signal 11 (SIGSEGV) when ldap_uri is misconfigured.
• BZ - 703624 - SSSD's async resolver only tries the first nameserver in /etc/resolv.conf
• BZ - 705434 - IPA provider fails initgroups() if user is not a member of any group
• BZ - 707282 - latest sssd fails if ldap_default_authtok_type is not mentioned
• BZ - 707513 - Unable to authenticate users when username contains "\0"
• BZ - 707627 - Include valid "ldap_uri" formats in sssd-ldap man page
• BZ - 707997 - The IPA provider does not work with IPv6
• BZ - 708009 - "renew_all_tgts" and "renew_handlers" messages are being logged multiple times when the provider comes back online.
• BZ - 709081 - sssd.$arch should require sssd-client.$arch
• BZ - 709342 - Typo in negative cache notification for initgroups()
• BZ - 711416 - During the change password operation the ccache is not replaced by a new one if the old one isn't active anymore.
• BZ - 713438 - sssd shuts down if inotify crashes
• BZ - 713961 - libsss_ldap segfault at login against OpenLDAP
• BZ - 715609 - Certificate validation fails with message "Connection error: TLS: hostname does not match CN in peer certificate"
• BZ - 718250 - Remove DENY rules from the HBAC access provider
• BZ - 719089 - IPA dynamic DNS update mangles AAAA records
• BZ - 725868 - "groups user" and "finger gecos" fails
• BZ - 726438 - sssd doesn't honor ldap supportedControls
• BZ - 726466 - HBAC rule evaluation does not support extended UTF-8 languages
• BZ - 726475 - sssd_pam leaks file descriptors.
• BZ - 728267 - When non-posix groups are skipped, initgroups returns random GID
• BZ - 728343 - SSSD taking 5 minutes to log in
• BZ - 732010 - LDAP+GSSAPI needs explicit Kerberos realm
• BZ - 732935 - Add LDAP provider option to set LDAP_OPT_X_SASL_NOCANON
• BZ - 733382 - SSSD should pick a user/group name when there are multi-valued names
• BZ - 733399 - Unable to enumerate rfc2307bis group with non-default attribute names.
• BZ - 733409 - Improve password policy error message
• BZ - 733663 - Authentication fails when there exists an empty hbacsvcgroup.
• BZ - 736314 - sssd crashes during auth while there exists multiple external hosts along with managed host.
• BZ - 737157 - "System error" appears in log during change password operation of a user in openldap server with ppolicy enabled.
• BZ - 737172 - "Unknown (private extension) error(21853), (null)" messages are logged during change password operation of a user in openldap server with ppolicy enabled.
• BZ - 738621 - Lookup fails for non-primary usernames with multi-valued uid.
• BZ - 738629 - Group lookups doesn't return it's member for sometime when the member has multi-valued uid.
• BZ - 740501 - SSSD not functional after "self" reboot
• BZ - 741751 - HBAC rule evaluation does not properly handle host groups
• BZ - 742278 - Rework the example config
• BZ - 742288 - RFC2307bis initgroups calls are slow
• BZ - 742295 - Use an explicit base 10 when converting uidNumber to integer
• BZ - 742526 - SSSD's man pages are missing information
• BZ - 743841 - SSSD can crash due to dbus server removing a UNIX socket
• BZ - 743925 - HBAC processing is very slow when dealing with FreeIPA deployments with large numbers of hosts.
• BZ - 745966 - sssd_pam segfaults on sssd restart
• BZ - 746654 - SSSD backend gets killed on slow systems
• BZ - 748412 - Memory leaks during the initgroups() operation
• BZ - 748924 - RHEL6.1/sssd_pam segmentation fault
• BZ - 749256 - SELinux errors with SSSD Downgrade

CVEs

(none)

References

• https://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/6.2_Technical_Notes/sssd.html#RHBA-2011-1529