RHBA-2016:2879 - Bug Fix Advisory

Topic

Updated 389-ds-base packages that fix several bugs are now available for Red Hat Enterprise Linux 7.

Description

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

This update fixes the following bugs:

• Previously, Identity Management closed the replication connection in the following scenario: The supplier has the "389-ds-base 1.2.11" package installed on Red Hat Enterprise Linux 6 and the consumer runs the 1.3.4 version or newer. Additionally, the supplier sends a custom schema to the consumer, that is a subset of the custom schema of the consumer. If all conditions met, the schema replication failed and as a consequence, no data is replicated. To fix the problem, the schema replication failure event has been changed from "FATAL" to "NOT FATAL". As a result, a failed schema replication process no longer interrupts the data replication. (BZ#1384785)
• The Directory Server setup script uses the "host" utility to look up host names and IP addresses. As a consequence, on systems that do not have the bind-utils package installed, the setup script fails. To fix the problem, bind-utils has been added as a dependency to the 389-ds-base package. As a result, the Directory Server setup script no longer fails because of a missing dependency. (BZ#1388501)
• When FIPS mode is enabled in the network security services (NSS) database, the token name changes. This prevents the server from reverse decoding the replication manager's password. Consequently, replication sessions using SSL or TLS to a replica server fail. This patch prepares Directory Manager to fix the problem. However, the bug in the nss package will be fixed in a future update of NSS. (BZ#1388581)
• Previously, when "acctPolicySubentry" was not set in the "specattrname" parameter of the account policy plug-in, incorrect base distinguished name (DN) was used. As a consequence, the "ns-accountstatus.pl" script incorrectly showed the wrong status for accounts inactivated by inactivity. To fix the problem, the script now uses the existing config entry to obtain the inactivity limit if no "acctPolicySubentry" is set. As a result, the script now shows the correct status. (BZ#1390342)
• Previously, when the "Trace function calls" option was enabled in the "nsslapd-errorlog-level" parameter, all attributes were logged into the Directory Server's error log file including attributes containing sensitive information. A patch has been applied to filter out values of sensitive attributes. As a result, sensitive information are no longer written to the log files. (BZ#1390343)

Users of 389-ds-base are advised to upgrade to these updated packages, which fix these bugs. After installing this update, the 389 server service will be restarted automatically.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.5 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.3 x86_64
• Red Hat Enterprise Linux Server - AUS 7.7 x86_64
• Red Hat Enterprise Linux Server - AUS 7.6 x86_64
• Red Hat Enterprise Linux Server - AUS 7.4 x86_64
• Red Hat Enterprise Linux Server - AUS 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Enterprise Linux for Power, little endian 7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.6 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.5 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.4 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.3 ppc64le
• Red Hat Enterprise Linux Server - TUS 7.7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.6 x86_64
• Red Hat Enterprise Linux Server - TUS 7.3 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.7 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.6 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.5 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.4 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.3 x86_64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.7 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.6 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.4 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.3 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 ppc64le

Fixes

• BZ - 1384785 - Replica install fails with old IPA master sometimes during replication process
• BZ - 1388501 - 389-ds-base is missing runtime dependency - bind-utils
• BZ - 1388581 - Replication stops working only when fips mode is set to true
• BZ - 1390342 - ns-accountstatus.pl shows wrong status for accounts inactivated by Account policy plugin
• BZ - 1390343 - trace args debug logging must be more restrictive

CVEs

(none)

References

(none)