RHBA-2018:0811 - Bug Fix Advisory

Topic

An update for 389-ds-base is now available for Red Hat Enterprise Linux 7.

Description

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.5 Release Notes linked from the References section.

Users of 389-ds-base are advised to upgrade to these updated packages.

Solution

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.6 x86_64
• Red Hat Enterprise Linux Server - AUS 7.7 x86_64
• Red Hat Enterprise Linux Server - AUS 7.6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for IBM z Systems 7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.6 s390x
• Red Hat Enterprise Linux for Power, big endian 7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.6 ppc64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Enterprise Linux for Power, little endian 7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.6 ppc64le
• Red Hat Enterprise Linux Server - TUS 7.7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x
• Red Hat Enterprise Linux for ARM 64 7 aarch64
• Red Hat Enterprise Linux for Power 9 7 ppc64le
• Red Hat Enterprise Linux EUS Compute Node 7.7 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.6 x86_64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.7 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.6 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.6 x86_64
• Red Hat Enterprise Linux for IBM System z (Structure A) 7 s390x
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 ppc64le

Fixes

• BZ - 1185774 - Missing warning for invalid replica backoff configuration
• BZ - 1192099 - IPA server replication broken, after DS stop-start, due to changelog reset
• BZ - 1271208 - nsds5ReplicaProtocolTimeout attribute accepts negative values
• BZ - 1274420 - entry distribution functions should use normalized values
• BZ - 1274430 - [RFE] Handling replication conflict entries
• BZ - 1352121 - [RFE] allow to enable MemberOf plugin in dedicated consumer
• BZ - 1406351 - [RFE] Need a tool to compare entries on LDAP servers.
• BZ - 1417341 - remove changelog semaphore
• BZ - 1434335 - Errors log filled with attrlist_replace - attr_replace (nsslapd-referral, ldap://<host>:389/o%3Dipaca) failed.
• BZ - 1438526 - Server allows to set any nsds5replicaid in the existing replica entry
• BZ - 1445188 - Misleading error message - Incoming BER Element was 3 bytes
• BZ - 1447308 - Add option to show full un-ellipsized output in status-dirsrv
• BZ - 1453155 - unable to retrieve specific cosAttribute when subtree password policy is configured.
• BZ - 1457315 - cmocka tests are not executed during rpm build
• BZ - 1458536 - Performance issues with RHDS 10 - NDN cache investigation.
• BZ - 1459946 - GetEffectiveRights gives false-negative with ACIs containing targetfilter
• BZ - 1459965 - repl-monitor - matches null string many times in regex
• BZ - 1460070 - 1.3.5.10-20 replication halt - pending list first CSN not committed, pending list increasing
• BZ - 1460718 - The default log level 16384 is stripped from the log level returned to a client.
• BZ - 1461437 - crash in send_ldap_result
• BZ - 1463204 - Adding a database entry fails if the same database was deleted after an import
• BZ - 1464463 - Replication fails to start with CBCA (Certificate-Based Client Authentication) while FIPS mode is enabled.
• BZ - 1464505 - password expired control not sent during grace logins.
• BZ - 1465383 - Segmentation fault in valueset_array_to_sorted_quick
• BZ - 1465600 - PasswordCheckSyntax attribute fails to validate cn, sn, uid and mail attributes
• BZ - 1466191 - Change the retrochangelog default cache size. And also if possible, the default caches.
• BZ - 1467777 - "pwdhash -D configdir" uses the DS default hashing algorithm
• BZ - 1469567 - Activating roles returns error 16
• BZ - 1470169 - Rebase 389-ds-base in RHEL 7.5 to 1.3.7
• BZ - 1474100 - Use of uninitialized value in string ne at /usr/bin/logconv.pl
• BZ - 1476207 - Enabling instance service doesn't work
• BZ - 1476322 - backup fails if changelog is enabled
• BZ - 1483681 - Crash while binding to a server during replication online init
• BZ - 1488836 - directory server fails to start because maxdisksize (nsslapd-*log-logmaxdiskspace ) is recognized incorrectly
• BZ - 1491706 - Adding an invalid replication agreement crashes the server
• BZ - 1492821 - Fix regression that was missed in 389-ds-base-1.3.6
• BZ - 1498773 - Installation of ipa fails with crash in topology plugin
• BZ - 1498980 - heap corruption during import.
• BZ - 1501058 - [memberOf Plugin] bulk deleting users causes deadlock when there are multiple backends
• BZ - 1506425 - Improve valueset sort performance during valueset purging
• BZ - 1506831 - replicated MODRDN fails breaking replication.
• BZ - 1507194 - cleanallruv could break replication if anchor csn in ruv originated in deleted replica
• BZ - 1509016 - cleanallruv task is not logging any information
• BZ - 1510865 - python-ldap is not a dependency of 389-ds-base
• BZ - 1511462 - scope one searches give incorrect results
• BZ - 1511885 - Automatically load /usr/lib/sysctl.d/70-dirsrv.conf after installing 389-ds-base
• BZ - 1513467 - IPA upgrade fails for latest ipa package
• BZ - 1514033 - opened connection are hanging, no longer poll
• BZ - 1516309 - After cleanALLruv, replication is looping on keep alive DEL
• BZ - 1517383 - ns-slapd segfaults with ERR - connection_release_nolock_ext - conn=0 fd=0 Attempt to release connection that is not acquired
• BZ - 1517788 - password policy: minimum token length fails when the token lenght is equal to attribute length.
• BZ - 1517980 - stack-buffer-overflow in slapi_pblock_get
• BZ - 1518069 - heap-buffer-overflow in ss_unescape
• BZ - 1518287 - heap-use-after-free in csn_as
• BZ - 1523183 - search with CoS attribute is getting slower after modifying/adding CosTemplate
• BZ - 1531153 - Indexing of internationalized matching rules is failing
• BZ - 1533571 - memberof: schema violation error message is confusing as memberof will likely repair target entry
• BZ - 1533828 - Server allows to set nsds5replicaid=65535 in the existing replica entry
• BZ - 1534462 - kinit command doesnot work post ipa-server install
• BZ - 1535515 - local password policies should use the same defaults as the global policy
• BZ - 1539082 - Child entry cenotaphs should not prevent the deletion of the parent
• BZ - 1541108 - Allow CRL handling to be configurable for outgoing connections
• BZ - 1542645 - Outgoing secure connection is failing with recent OpenLDAP

CVEs

(none)

References

• https://access.redhat.com/documentation/en-US/red_hat_enterprise_linux/7/html/7.5_release_notes/index.html