RHBA-2017:2086 - Bug Fix Advisory

Topic

An update for 389-ds-base is now available for Red Hat Enterprise Linux 7.

Description

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.4 Release Notes linked from the References section.

Users of 389-ds-base are advised to upgrade to these updated packages.

Solution

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.5 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.4 x86_64
• Red Hat Enterprise Linux Server - AUS 7.7 x86_64
• Red Hat Enterprise Linux Server - AUS 7.6 x86_64
• Red Hat Enterprise Linux Server - AUS 7.4 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for IBM z Systems 7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.5 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.4 s390x
• Red Hat Enterprise Linux for Power, big endian 7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.6 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.5 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.4 ppc64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Enterprise Linux for Power, little endian 7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.6 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.5 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.4 ppc64le
• Red Hat Enterprise Linux Server - TUS 7.7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x
• Red Hat Enterprise Linux EUS Compute Node 7.7 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.6 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.5 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.4 x86_64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.7 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.6 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.4 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.4 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 ppc64le

Fixes

• BZ - 1049190 - Better input argument validation and error messages for db2index and db2index.pl.
• BZ - 1246164 - fractional replication needs a better handling of ruvs
• BZ - 1257459 - [RFE] Add classification information to error logs and a way to process them in an automated fashion.
• BZ - 1258613 - Add PBKDF2 to the list of supported hashing functions in the 389 server
• BZ - 1266206 - Allow PRE_BIND plugins to mangle DNs
• BZ - 1266991 - Allow usage of OpenLDAP libraries that don't use NSS for crypto
• BZ - 1298681 - nunc-stans -- upgrading liblfds
• BZ - 1348838 - Default Setting for passwordMinTokenLength does not work
• BZ - 1357682 - RHDS fails to start with message: "Failed to delete old semaphore for stats file"
• BZ - 1362239 - [RFE] Optimize memberOf plug-in
• BZ - 1364277 - on a read only replica invalid state info can accumulate
• BZ - 1377452 - Integer overflow in performance counters
• BZ - 1377730 - Replica install fails with old IPA master sometimes during replication process
• BZ - 1378209 - Replication stops working only when fips mode is set to true
• BZ - 1379424 - Reset incremental update status after re-initialization
• BZ - 1379824 - ns-accountstatus.pl shows wrong status for accounts inactivated by Account policy plugin
• BZ - 1381326 - dirsrv-snmp.service is provided by 389-ds-base instead of 389-ds-base-snmp
• BZ - 1384061 - ldapmodify on nsslapd-db-locks no longer works
• BZ - 1386124 - 389-ds-base is missing runtime dependency - bind-utils
• BZ - 1387340 - Aborted operation can leave RUV in incorrect state
• BZ - 1387771 - trace args debug logging must be more restrictive
• BZ - 1388567 - Rebase 389-ds-base to 1.3.6 in RHEL-7.4
• BZ - 1390809 - Non tombstone entry which dn starting with "nsuniqueid=...," cannot be deleted
• BZ - 1391204 - (un)register/migration/remove may fail if there is no suffix on 'userRoot' backend
• BZ - 1391700 - do not treat missing csn as fatal
• BZ - 1394000 - dbmon.sh fails if you have nsslapd-require-secure-binds enabled
• BZ - 1394899 - RHDS should ignore passwordMinAge if "password must reset" is true
• BZ - 1395940 - [RFE] Autotune threads at startup
• BZ - 1396448 - Add a hard dependency for >=selinux-policy-3.13.1-75
• BZ - 1396557 - ldif2db does not run the actual import if option -v ( verbose ) is used.
• BZ - 1397288 - Typo in logconv.pl man page
• BZ - 1400653 - Improve memberof performance, caching for each group their ancestors DN
• BZ - 1404443 - incompatible nsEncryptionConfig object definition prevents RHEL 7->6 schema replication
• BZ - 1405257 - Setting nsDS5ReplicatedAttributeList nsDS5ReplicatedAttributeListTotal on replication agreements does not work
• BZ - 1406101 - Importing big ldif file with duplicate DNs throwing "unable to flush" error
• BZ - 1406838 - memberOf fixup task does not validate args
• BZ - 1410207 - Utility command had better use INFO log level for the output?
• BZ - 1410514 - deadlock on cos cache rebuild
• BZ - 1411944 - Release 1.3.5 may allow expired accounts access to systems
• BZ - 1412362 - 389-ds-base rpm postinstall script bugs
• BZ - 1417338 - To debug DB_DEADLOCK condition, allow to reset DB_TXN_NOWAIT flag on txn_begin
• BZ - 1417344 - case sensitivity in ACI
• BZ - 1418202 - ns-slapd dies under heavy load
• BZ - 1419162 - A filtered nsrole that specifies an empty nsrole in its nsRoleFilter will result in a segfault.
• BZ - 1420960 - Need a way for plugin to modify the request during ADD op. after the ACIs are evaluated
• BZ - 1425837 - [RFE] Change default memory allocator to tcmalloc
• BZ - 1425906 - [RFE] Enable nunc-stans by default
• BZ - 1425907 - [RFE] Harden default password storage scheme
• BZ - 1429770 - ds-logpipe.py crashes for non-existing users
• BZ - 1431207 - ns-slapd killed by SIGABRT
• BZ - 1431877 - 389-1.3.6.1-1.el7 covscan errors
• BZ - 1432016 - Possible deadlock while installing an ipa replica.
• BZ - 1432149 - sasl external binds fail in 1.3.6.1
• BZ - 1432206 - content sync plugin can hang server shutdown
• BZ - 1433697 - Double free in _ldap/servers/plugins/replication/cl5_api.c:cl5NewDBFile()
• BZ - 1433850 - Directory Server hangs and utilizes high CPU when deleting a non-leaf entry
• BZ - 1433996 - ns-slapd crash during shutdown
• BZ - 1434967 - Broken CFLAGS provided by the dirsrv pkgconfig file
• BZ - 1435122 - IPA server installs fails with error message - No local ID range and no admins group found
• BZ - 1436994 - Incorrect paths it in pkgconfig dirsrv.pc - doubled slashes
• BZ - 1437492 - "ERR - cos-plugin - cos_cache_query_attr - cos attribute krbPwdPolicyReference failed schema check" in error log
• BZ - 1438029 - Overflow in memberof
• BZ - 1441522 - AddressSanitizer: heap-use-after-free in libreplication-plugin.so
• BZ - 1441790 - ldapserch for nsslapd-errorlog-level returns incorrect values
• BZ - 1442880 - setup-ds-admin.pl -u with nsslapd-localhost changed
• BZ - 1443682 - util_info_sys_pages should be able to detect memory restrictions in a cgroup
• BZ - 1444431 - ERR - symload_report_error - Netscape Portable Runtime error -5975: /usr/lib64/dirsrv/plugins/libsyntax-plugin.so: undefined symbol: nis_plugin_init_betxn_postop
• BZ - 1444938 - nsslapd-allowed-sasl-mechanisms doesn't reset to default values without a restart
• BZ - 1446154 - ns-slapd - LOGINFO:Unable to remove file (frontport to rhel7)
• BZ - 1447015 - Adjust db2bak.pl help and man page to reflect changes introduced to the script
• BZ - 1449098 - ns-slapd crashes in role cache creation.
• BZ - 1451657 - -v option is not working for db2ldif.pl
• BZ - 1452739 - Zero value of nsslapd-cache-autosize-split makes dbcache to be equal 0
• BZ - 1454921 - Fixup memberof task throws error "memberof_fix_memberof_callback: Weird "
• BZ - 1456774 - ipa-replica server fails to upgrade

CVEs

(none)

References

• https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/7.4_Release_Notes/index.html