RHBA-2017:0385 - Bug Fix Advisory

Topic

Updated 389-ds-base packages that fix several bugs are now available for Red Hat Enterprise Linux 7.

Description

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

This update fixes the following bugs:

• Previously, if the suffix of the "userRoot" default back end was not found in the "nsslapd-suffix" attribute, Directory Server scripts used for registering and unregistering back ends lost the suffix information and failed. A patch has been applied and Directory Server now ignores the empty suffix in the mentioned situation. (BZ#1414677)
• Previously, if the cos_post_op() function was called while the back-end database was locked, a deadlock occurred when rebuilding the Class of Service (CoS) cache. Directory Server now rebuilds the CoS cache without requiring the internal lock. As a result, the deadlock situation no longer occurs in the described situation. (BZ#1414678)
• Due to a bug, the "shadowExpire" attribute was incorrectly set. As a consequence, expired accounts were able to log in. A patch has been provided and Directory Server no longer incorrectly sets the "shadowExpire" attribute. As a result, expired accounts cannot log in. Additionally, this update now only sets the "shadow*" attributes if the password policy is enabled and the corresponding value is configured. (BZ#1414679)
• Previously, if a plug-in operation succeeded, but the operation itself failed and was aborted, the replica update vector (RUV) was in an incorrect state. The change state number (CSN) has been redesigned and now uses a primary and secondary CSN. The primary CSN is associated with the main operation. Other internal operations, including the ones called from the plug-ins, use the secondary CSN. Using the CSN class difference, Directory Server no longer generates an inconsistent state in the RUV in the described situation. (BZ#1416368)

Users of 389-ds-base are advised to upgrade to these updated packages, which fix these bugs. After installing this update, the 389 server service will be restarted automatically.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.5 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.3 x86_64
• Red Hat Enterprise Linux Server - AUS 7.7 x86_64
• Red Hat Enterprise Linux Server - AUS 7.6 x86_64
• Red Hat Enterprise Linux Server - AUS 7.4 x86_64
• Red Hat Enterprise Linux Server - AUS 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Enterprise Linux for Power, little endian 7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.6 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.5 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.4 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.3 ppc64le
• Red Hat Enterprise Linux Server - TUS 7.7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.6 x86_64
• Red Hat Enterprise Linux Server - TUS 7.3 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.7 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.6 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.5 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.4 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.3 x86_64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.7 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.6 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.4 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.3 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 ppc64le

Fixes

• BZ - 1414677 - (un)register/migration/remove may fail if there is no suffix on 'userRoot' backend
• BZ - 1414678 - deadlock on cos cache rebuild
• BZ - 1414679 - Release 1.3.5 may allow expired accounts access to systems
• BZ - 1416368 - Aborted operation can leave RUV in incorrect state

CVEs

(none)

References

• https://access.redhat.com/solutions/2853491