RHBA-2017:2932 - Bug Fix Advisory

Topic

Updated 389-ds-base packages that fix several bugs are now available for Red Hat Enterprise Linux 7.

Description

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

This update fixes the following bugs:

• Previously, multiple worker threads used a single normalized Distinguished Name (DN) cache. Consequently, if multiple clients performed operations on Directory Server, performance decreased. With this update, Directory Server now creates separate normalized DN caches for each worker thread. As a result, performance no longer decreases in the mentioned scenario. (BZ#1486128)
• Previously, subtree and user password policies did not use the same default values as the global password policy. As a consequence, Directory Server incorrectly skipped certain syntax checks. This bug has been fixed. As a result, the password policy features work the same for the global configuration and the subtree and user policies. (BZ#1489693)
• When a Directory Server plug-in runs an internal search, it passes the base search parameter to the core server. Previously, Directory Server did not check if this parameter was valid. As a consequence, if the base search was set to NULL, the core server terminated unexpectedly. The code has been updated. As a result, Directory Server no longer terminates unexpectedly if a plug-in uses an invalid base search parameter. (BZ#1489694)
• Prior to this update, if you created a replication agreement and set the value of the nsds5ReplicEnabled attribute to any value other than on or off, Directory Server terminated unexpectedly. This update fixes the problem. As a result, Directory Server no longer fails when adding an invalid replication agreement. (BZ#1491778)
• Due to a bug, adding or deleting a back end in Directory Server previously failed, and an "Error 53 (UNWILLING_TO_PERFORM)" was displayed. This update fixes the problem. As a result, adding and removing back ends work as expected. (BZ#1492829)
• Previously, Directory Server did not send the expired password control when an expired password had grace logins left. Consequently, clients could not tell the user that the password was expired or how many grace logins were left. The problem has been fixed. As a result, clients can now tell the user if a password is expired and how many grace logins remain. (BZ#1492830)
• Previously, when setting multiple allowed SASL mechanisms in the nsslapd-allowed-sasl-mechanisms attribute, the list was incorrectly truncated. As a result, when the instance shut down, Directory Server wrote the truncated list into the /etc/dirsrv/instance_name/dse.ldif file. This update fixes the problem. As a result, Directory Server stores the complete allowed SASL mechanisms list when you shutdown the service. (BZ#1492833)
• Previously, when using an indirect Class of Service (CoS) together with a local password policy, Directory Server set a flag after reading the password policy CoS. However, this flag was not reset before reading the indirect CoS definitions. As a consequence, Directory Server treated the indirect CoS attributes as operational attributes, and the indirect CoS did not correctly merge virtual attributes. With this update, Directory Server resets the flag, and all CoS definitions work as expected. (BZ#1498958)

Users of 389-ds-base are advised to upgrade to these updated packages, which fix these bugs. After installing this update, the 389 server service will be restarted automatically.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.5 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.4 x86_64
• Red Hat Enterprise Linux Server - AUS 7.7 x86_64
• Red Hat Enterprise Linux Server - AUS 7.6 x86_64
• Red Hat Enterprise Linux Server - AUS 7.4 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for IBM z Systems 7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.5 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.4 s390x
• Red Hat Enterprise Linux for Power, big endian 7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.6 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.5 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.4 ppc64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Enterprise Linux for Power, little endian 7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.6 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.5 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.4 ppc64le
• Red Hat Enterprise Linux Server - TUS 7.7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.6 x86_64
• Red Hat Enterprise Linux Server - TUS 7.4 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x
• Red Hat Enterprise Linux EUS Compute Node 7.7 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.6 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.5 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.4 x86_64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.7 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.6 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.4 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.4 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 ppc64le

Fixes

• BZ - 1486128 - Performance issues with RHDS 10 - NDN cache investigation. [rhel-7.4.z]
• BZ - 1489693 - PasswordCheckSyntax attribute fails to validate cn, sn, uid and mail attributes [rhel-7.4.z]
• BZ - 1489694 - crash in send_ldap_result [rhel-7.4.z]
• BZ - 1491778 - Adding an invalid replication agreement crashes the server [rhel-7.4.z]
• BZ - 1492829 - Fix regression that was missed in 389-ds-base-1.3.6 [rhel-7.4.z]
• BZ - 1492830 - password expired control not sent during grace logins. [rhel-7.4.z]
• BZ - 1498958 - unable to retrieve specific cosAttribute when subtree password policy is configured. [rhel-7.4.z]

CVEs

(none)

References

(none)