RHBA-2015:2351 - Bug Fix Advisory

Topic

Updated 389-ds-base packages that fix several bugs and add various enhancements are now available for Red Hat Enterprise Linux 7.

The 389 Directory Server is an LDAP version 3 (LDAPv3) compliant server.

Description

The 389-ds-base packages have been upgraded to upstream version 1.3.4.0, which provides a number of bug fixes and enhancements over the previous version. (BZ#1201892)

Bug fixes:

• When multi-master replication was configured, this redundant error message was recorded in the log:

NSMMReplicationPlugin - write_changelog_and_ruv:
failed to update RUV for unknown

The message is no longer displayed. (BZ#1096409)

• When the subtree level was deeper than one, Directory Server sometimes did not select the closest above password policy for the target user entry. The bug has been fixed along with the nested Class of Service (CoS). (BZ#1180331)
• A helper function to check whether the cache size is valid was resetting the entry and Distinguished Name (DN) cache size to very small values. Now, the helper function provides only the validity check and no longer resets the cache size. (BZ#1226510)
• The "No original_tombstone for changenumber" error message was logged unnecessarily when no original_tombstone value was defined. The message is now logged only when necessary. (BZ#1235847)
• After the cleanAllRUV task finished, the change log still contained entries from the cleaned rid. Now, cleanAllRUV cleans the change log completely as expected. (BZ#1240845)
• The verify-db.pl utility ignored the "-a" option, which specifies the path to the database directory, and instead used the path defined in the Directory Server configuration. The utility now respects "-a" as expected. (BZ#1240876)
• When AD users had multiple spaces inside the value of the RDN attribute, synchronizing the entry to the Directory Server failed. Now, the WinSync plug-in works as expected. (BZ#1242683)
• A bug in WinSync account synchronization has been fixed. The ntuserlastlogon attribute is updated on the Directory Server side based upon the lastLogonTimestampand attribute in Active Directory. (BZ#1245235)
• This update adds scoping to the retrocl plug-in and moves the existing memberOf scoping outside the memberOf global lock. The memberOf and retrocl plug-ins no longer enter a deadlock state when updating multiple back ends at the same time. (BZ#1245519)
• Complex filters in a search request did not work as expected. Now, the filter optimization no longer mistakenly ignores certain complex subfilters. (BZ#1258996)
• When multiple replica update vector (RUV) updates were skipped in fractional replication, RUV was not updated at the end of the session, and the next session restarted evaluating the same skipped updates. This update prevents the unnecessary replays. (BZ#1259949)

Enhancements:

• Verifying whether the timestamp of a log is within the start and end times of an event has been improved. The logconv.pl log analysis utility has been improved so that the log report is no longer empty when an event time range does not match the timestamp. (BZ#1160243)
• To improve replication throughput, the nsDS5ReplicaWaitForAsyncResults attribute has been added to the nsDS5ReplicationAgreement class. The attribute defines how long a supplier waits for the response from a consumer. Its value is specified in milliseconds; the default is 1 second. (BZ#1171358)
• Added the memberOfSkipNested attribute, which accepts the "on" or "off" values, to improve delete performance when no nested groups are present. When set to "on", nested group lookups are not performed during a group delete operation. (BZ#1174457)
• A new Nunc Stans event framework to handle multiple simultaneous connections has been added as Technology Preview. The framework allows supporting several thousand active connections with no performance degradation. It is disabled by default. (BZ#1206301)

Users of 389-ds-base are advised to upgrade to these updated packages, which fix these bugs and add these enhancements. After installing this update, the 389 server service will be restarted automatically.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.5 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.3 x86_64
• Red Hat Enterprise Linux Server - AUS 7.7 x86_64
• Red Hat Enterprise Linux Server - AUS 7.6 x86_64
• Red Hat Enterprise Linux Server - AUS 7.4 x86_64
• Red Hat Enterprise Linux Server - AUS 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Enterprise Linux Server from RHUI 7 x86_64
• Red Hat Enterprise Linux for Power, little endian 7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.6 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.5 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.4 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.3 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.2 ppc64le
• Red Hat Enterprise Linux Server - TUS 7.7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.6 x86_64
• Red Hat Enterprise Linux Server - TUS 7.3 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.7 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.6 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.5 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.4 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.3 x86_64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.7 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.6 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.4 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.3 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 ppc64le

Fixes

• BZ - 1034325 - Linked attributes betxnpreoperation - transaction not aborted when linked entry does not exit
• BZ - 1052755 - Retro Changelog Plugin accepts invalid value in nsslapd-changelogmaxage attribute
• BZ - 1095603 - Any negative error code number reported as Illegal error by ldclt.
• BZ - 1145378 - Adding an entry with an invalid password as rootDN is incorrectly rejected
• BZ - 1145382 - Bad manipulation of passwordhistory
• BZ - 1154147 - Uniqueness plugin: should allow to exclude some subtrees from its scope
• BZ - 1168675 - Inconsistent behaviour of DS when LDAP Sync is used with an invalid cookie
• BZ - 1171358 - [RFE] - Make ReplicaWaitForAsyncResults configurable
• BZ - 1171663 - MODDN fails when entry doesn't have memberOf attribute and new DN is in the scope of memberOfExcludeSubtree
• BZ - 1174457 - [RFE] memberOf - add option to skip nested group lookups during delete operations
• BZ - 1178640 - db2bak.pl man page should be improved.
• BZ - 1179370 - COS cache doesn't properly mark vattr cache as invalid when there are multiple suffixes
• BZ - 1181341 - nsslapd-changelogtrim-interval and nsslapd-changelogcompactdb-interval are not validated
• BZ - 1185882 - ns-activate.pl fails to activate account if it was disabled on AD
• BZ - 1186548 - ns-slapd crash in shutdown phase
• BZ - 1189154 - DNS errors after IPA upgrade due to broken ReplSync
• BZ - 1201892 - Rebase 389-ds-base to 1.3.4 in RHEL-7.2
• BZ - 1206301 - [RFE] new connection handling, event loop, etc.
• BZ - 1206309 - winsync sets AccountUserControl in AD to 544
• BZ - 1210845 - slapd crashes during Dogtag clone reinstallation
• BZ - 1210850 - add an option '-u' to dbgen.pl for adding group entries with uniquemembers
• BZ - 1210852 - aci with wildcard and macro not correctly evaluated
• BZ - 1226309 - GER control returns two 'n' in entryLevelRights attribute
• BZ - 1226510 - idm/ipa 389-ds-base entry cache converges to 500 KB in dblayer_is_cachesize_sane
• BZ - 1228823 - async simple paged results issue
• BZ - 1230996 - nsSSL3Ciphers preference not enforced server side (regression)
• BZ - 1235060 - Fix coverity issues
• BZ - 1235387 - Slow replication when deleting large quantities of multi-valued attributes
• BZ - 1235847 - handling of "No original_tombstone for changenumber" errors
• BZ - 1237325 - reindex off-line twice could provoke index corruption
• BZ - 1238790 - ldapsearch on nsslapd-maxbersize returns 0 instead of current value
• BZ - 1240404 - setup-ds.pl does not log invalid --file path errors the same way as other errors.
• BZ - 1240406 - setup -u stops after first failure
• BZ - 1240845 - cleanallruv should completely clean changelog
• BZ - 1240876 - verify_db.pl doesn't verify DB specified by -a option.
• BZ - 1241497 - crash in ns-slapd when deleting winSyncSubtreePair from sync agreement
• BZ - 1241723 - cleanallruv hangs shutdown if not all replicas online
• BZ - 1242531 - logconv.pl should handle *.tar.xz, *.txz, *.xz log files
• BZ - 1243950 - When starting a replica agreement a deadlock can occur with an op updating nsuniqueid index
• BZ - 1243970 - In MMR, double free could occur under some special condition
• BZ - 1244926 - Crash while triming the retro changelog
• BZ - 1246389 - wrong password check if passwordInHistory is decreased.
• BZ - 1247811 - logconv autobind handling regression caused by 47446
• BZ - 1249784 - ipa-dnskeysyncd unhandled exception on named-pkcs11 start
• BZ - 1250177 - Investigate betxn plugins to ensure they return the correct error code
• BZ - 1252082 - removing chaining database links trigger valgrind read errors
• BZ - 1252133 - replica upgrade failed in starting dirsrv service
• BZ - 1252207 - bashisms in 389-ds-base admin scripts
• BZ - 1252533 - Man pages and help for remove-ds.pl doesn't display "-a" option
• BZ - 1252781 - Slapd crashes reported from latest builds of 389-ds-base-1.3.4.0-10
• BZ - 1254344 - Server crashes in ACL_LasFindFlush during shutdown if ACIs contain IP addresss restrictions
• BZ - 1255851 - Shell CLI fails with usage errors if an argument containing white spaces is given
• BZ - 1256938 - Unable to dereference unqiemember attribute because it is dn [#UID] not dn syntax
• BZ - 1257294 - Enhance ACIs to have more control over MODRDN operations
• BZ - 1258996 - Some filters in RHDS10 are not working fine.
• BZ - 1259949 - Fractional replication evaluates several times the same CSN
• BZ - 1264224 - segfault in ns-slapd due to accessing Slapi_DN freed in pre bind plug-in
• BZ - 1266944 - ns-slapd crash during ipa-replica-manage del

CVEs

(none)

References

• http://www.redhat.com/security/updates/classification/#normal