RHBA-2016:0211 - Bug Fix Advisory

Topic

Updated ipa packages that fix several bugs are now available for Red Hat Enterprise Linux 7.

Description

Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments.

This update fixes the following bugs:

• The ipa packages require openssl packages of version 1.0.1e-42 or later. Previously, this requirement was missing from the spec file. As a consequence, upgrade of an IdM server could fail upon creating a SoftHSM database. With this update, the dependency on the correct version of openssl has been added to the spec file. As a result, the SoftHSM database is created and the upgrade is successful. (BZ#1298097)
• Prior to this update, an incorrect NIS server configuration container was created during an upgrade. Consequently, using the ipa-nis-manage utility did not create the required NIS maps, which could cause problems to users. The upgrade code has been fixed, the NIS maps are now correctly created, and the enabled NIS server works as expected. (BZ#1298098)
• If a umask was set to 077, files in the softhsm directory were created with incorrect permissions. Consequently, the named server was unable to read keys from the SoftHSM database and failed to start. With this update, the correct permissions are set, and the named service starts successfully in this scenario. (BZ#1298099)
• The version check during an IdM Server upgrade did not detect Red Hat Enterprise Linux version 7.2.z as a later one. Consequently, it was impossible to upgrade an IdM Server from version 7.2 to 7.2.z. This bug has been fixed, and the upgrade of an IdM Server from version 7.2 to 7.2.z is now successful. (BZ#1298100)
• Keys in the sysrestore file were normalized to lowercase values. Previously, the sysrestore utility did not expect that keys had been migrated to lowercase, and did not return the correct state. Consequently, this could cause rewriting of the kasp.db DNSSEC database. With this update, the sysrestore utility is now case-sensitive, the DNSSEC database is no longer accidentally rewritten, and all sysrestore operations work as expected. (BZ#1298101)
• The ipa-ods-exporter utility and the ipa-dnskeysyncd daemon did not properly handle DNSSEC key purging, which is automatically done by the OpenDNSSEC Enforcer daemon 14 days after the particular key is no longer in use. Consequently, DNSSEC key synchronization stopped working 14 days after a key rotation. Because Zone Signing Key (ZSK) is rotated every 3 months, the problem typically occurred 3 months and 14 days after DNSSEC was enabled for the first DNS zone. With this update, ipa-ods-exporter and ipa-dnskeysyncd have been fixed to properly handle key purging, and key distribution now works as expected after a key purging event. (BZ#1298102)
• The ipa-server-upgrade utility checks for a running certmonger service at the start of the upgrade process and raises an error if the service is not running. Previously, when the Certificate System CA service was not configured, a running certmonger service was not required, and the check always failed. Consequently, this effectively prevented the upgrade of a CA-less IdM master to later versions. With this update, the certmonger service is started also when the CA service is not configured, and the upgrade of a CA-less IdM master works as expected. (BZ#1298103)
• If the "skip_version_check" option was enabled, the IdM client identified itself as a client of IdM API version 2.51 to the IdM server. When the IdM API version of the IdM server was earlier than 2.51, the "skip_version_check" option on the client had no effect. Consequently, all API calls failed with an incompatible version error. With this update, if the "skip_version_check" option is enabled, the IdM client is identified as a client of IdM API version 2.0 to the IdM server, and the API calls no longer fail in the described scenario. (BZ#1298104)

Users of ipa are advised to upgrade to these updated packages, which fix these bugs.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.5 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.3 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.2 x86_64
• Red Hat Enterprise Linux Server - AUS 7.7 x86_64
• Red Hat Enterprise Linux Server - AUS 7.4 x86_64
• Red Hat Enterprise Linux Server - AUS 7.3 x86_64
• Red Hat Enterprise Linux Server - AUS 7.2 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for IBM z Systems 7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.5 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.4 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.3 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.2 s390x
• Red Hat Enterprise Linux for Power, big endian 7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.6 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.5 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.4 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.3 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.2 ppc64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Enterprise Linux Server from RHUI 7 x86_64
• Red Hat Enterprise Linux Server - AUS 7.6 x86_64
• Red Hat Enterprise Linux for Power, little endian 7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.6 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.5 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.4 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.3 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.2 ppc64le
• Red Hat Enterprise Linux Server - TUS 7.7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.6 x86_64
• Red Hat Enterprise Linux Server - TUS 7.3 x86_64
• Red Hat Enterprise Linux Server - TUS 7.2 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x
• Red Hat Enterprise Linux EUS Compute Node 7.7 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.6 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.5 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.4 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.3 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.2 x86_64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.7 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.6 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.4 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.3 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.3 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.2 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 ppc64le

Fixes

• BZ - 1298097 - IPA server upgrade fails from RHEL 7.0 to RHEL 7.2 using "yum update ipa* sssd"
• BZ - 1298098 - ipa-nis-manage does not update ldap with all NIS maps
• BZ - 1298100 - Broken 7.2.0 to 7.2.z upgrade - flawed version comparison
• BZ - 1298101 - Sysrestore did not restore state if a key is specified in mixed case
• BZ - 1298102 - DNSSEC key purging is not handled properly
• BZ - 1298103 - ipa-server-upgrade fails if certmonger is not running
• BZ - 1298104 - The ipa -e skip_version_check=1 still issues incompatibility error when called against RHEL 6 server

CVEs

(none)

References

• http://www.redhat.com/security/updates/classification/#normal