RHBA-2014:1385 - Bug Fix Advisory

Topic

Updated 389-ds-base packages that fix several bugs and add one enhancement are
now available for Red Hat Enterprise Linux 6.

Description

The 389 Directory Server is an LDAPv3 compliant server. The base packages
include the Lightweight Directory Access Protocol (LDAP) server and command-line
utilities for server administration.

These updated 389-ds-base packages include numerous bug fixes and enhancements.
Space precludes documenting all of these changes in this advisory. Users are
directed to the Red Hat Enterprise Linux 6.6 Technical Notes for information on
the most significant of these changes:

https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/6.6_Technical_Notes/sec-389-ds-base.html#RHBA-2014-1385

Users of 389-ds-base are advised to upgrade to these updated packages, which fix
these bugs and add this enhancement. After installing this update, the 389
server service will be restarted automatically.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 i386

Fixes

• BZ - 1004876 - idlistscanlimit per index/type/value
• BZ - 1008021 - Self entry access ACI not working properly
• BZ - 1009122 - replication stops with excessive clock skew
• BZ - 1012699 - DSUtil.pm needs to check $res variable
• BZ - 1013133 - logconv.pl - RFE - track bind info
• BZ - 1013134 - Improve memory management in logconv.pl
• BZ - 1013135 - logconv.pl tool removes the access logs contents if "-M" is not correctly used
• BZ - 1013138 - logconv.pl should handle microsecond timing
• BZ - 1013140 - logconv.pl -m not working for all stats
• BZ - 1013141 - logconv.pl missing stats for starttls, ldapi, and autobind
• BZ - 1013142 - logconv.pl -m time calculation is wrong
• BZ - 1013152 - add etimes to per second/minute stats
• BZ - 1013160 - Indexed search are logged with 'notes=U' in the access logs
• BZ - 1013161 - improve logconv.pl performance with large access logs
• BZ - 1013162 - logconv warning - Use of comma-less variable list is deprecated at /usr/bin/logconv.pl line 630
• BZ - 1013163 - logconv.pl uses /var/tmp for BDB temp files
• BZ - 1013164 - Fix various issues with logconv.pl
• BZ - 1013165 - logconv: some stats do not work across server restarts
• BZ - 1014111 - [RFE - RHDS9] CLI report to monitor replication
• BZ - 1014351 - Coverity fixes - 12023, 12024, and 12025
• BZ - 1016717 - memory leak in range searches
• BZ - 1022500 - Winsync plugin segfault during incremental backoff
• BZ - 1024337 - Overflow in nsslapd-disk-monitoring-threshold on i686
• BZ - 1026956 - 1.2.11.29 crash when removing entries from cache
• BZ - 1027496 - Replication Failures related to skipped entries due to cleaned rids
• BZ - 1028344 - Slow ldapmodify operation time for large quantities of multi-valued attribute values
• BZ - 1031222 - hard coded limit of 64 masters in agreement and changelog code
• BZ - 1032315 - attrcrypt fails to find unlocked key
• BZ - 1032317 - entries with empty objectclass attribute value can be hidden
• BZ - 1033405 - regression in ipa due to patch for ns-slapd stuck in DS_Sleep
• BZ - 1034265 - 7-bit check plugin not checking MODRDN operation
• BZ - 1044106 - logconv: failed logins: Use of uninitialized value in numeric comparison at logconv.pl line 949
• BZ - 1044108 - logconv: -V does not produce unindexed search report
• BZ - 1044218 - fix memleak caused by 47347
• BZ - 1049029 - Windows Sync group issues
• BZ - 1057805 - Size returned by slapi_entry_size is not accurate
• BZ - 1060385 - Logconv.pl with an empty access log gives lots of errors
• BZ - 1062763 - single valued attribute replicated ADD does not work
• BZ - 1070583 - rhds91 389-ds-base-1.2.11.15-31.el6_5.x86_64 crash in db4 __dbc_get_pp env = 0x0 ?
• BZ - 1070720 - rsearch filter error on any search filter
• BZ - 1074076 - e_uniqueid fails to set if an entry is a conflict entry
• BZ - 1074305 - Under heavy stress, failure of turning a tombstone into glue makes the server hung
• BZ - 1077895 - Memory leak with proxy auth control
• BZ - 1079098 - Simultaneous adding a user and binding as the user could fail in the password policy check
• BZ - 1080185 - Creating a glue fails if one above level is a conflict or missing
• BZ - 1083272 - RHEL6.6 389-ds-base slapd segfault during ipa-replica-install
• BZ - 1086889 - empty modify returns LDAP_INVALID_DN_SYNTAX
• BZ - 1086901 - mem leak in do_bind when there is an error
• BZ - 1086903 - mem leak in do_search - rawbase not freed upon certain errors
• BZ - 1086907 - Performing deletes during tombstone purging results in operation errors
• BZ - 1090176 - regression in reassemble memberuid list
• BZ - 1092097 - A replicated MOD fails (Unwilling to perform) if it targets a tombstone
• BZ - 1094277 - IPA Server Slow Performance, high CPU usage of ns-slapd
• BZ - 1095847 - CoS cache re-scanning severely impacts performance
• BZ - 1097002 - Problem with deletion while replicated
• BZ - 1098653 - db2bak.pl error with changelogdb
• BZ - 1103287 - logconv.pl memory continually grows
• BZ - 1103337 - find a way to remove replication plugin errors messages "changelog iteration code returned a dummy entry with csn %s, skipping ..."
• BZ - 1106917 - managed entry plugin fails to update managed entry pointer on modrdn operation
• BZ - 1109333 - 389 Server crashes if uniqueMember is invalid syntax and memberOf plugin is enabled.
• BZ - 1109335 - Parent numsubordinate count can be incorrectly updated if an error occurs
• BZ - 1109337 - Nested tombstones become orphaned after purge
• BZ - 1109352 - Tombstone purging can crash the server if the backend is stopped/disabled
• BZ - 1109356 - Coverity issue in 1.3.3
• BZ - 1109358 - A tombstone entry is deleted by ldapdelete
• BZ - 1109363 - valgrind - value mem leaks, uninit mem usage
• BZ - 1109373 - provide default syntax plugin
• BZ - 1109377 - Environment variables are not passed when DS is started via service
• BZ - 1109379 - changelog iteration should ignore cleaned rids when getting the minCSN
• BZ - 1109381 - winsync doesn't sync DN valued attributes if DS DN value doesn't exist
• BZ - 1109384 - logconv.pl man page missing -m,-M,-B,-D
• BZ - 1109387 - IDL-style can become mismatched during partial restoration
• BZ - 1109443 - Server hangs in cos_cache when adding a user entry
• BZ - 1111404 - 1.2.11 branch: coverity errors
• BZ - 1112702 - Broken dereference control with the FreeIPA 4.0 ACIs
• BZ - 1112729 - paged results control is not working in some cases when we have a subsuffix.
• BZ - 1113606 - server restart wipes out index config if there is a default index
• BZ - 1121596 - Deleting attribute present in nsslapd-allowed-to-delete-attrs returns Operations error
• BZ - 1129660 - [WebUI] Adding users to user group throws Internal server error.
• BZ - 1130252 - RHEL6.6 dirsrv not running after ipa upgrade

CVEs

(none)

References

• https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/6.6_Technical_Notes/sec-389-ds-base.html#RHBA-2014-1385