RHBA-2018:0918 - Bug Fix Advisory

Topic

An update for ipa is now available for Red Hat Enterprise Linux 7.

Description

Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments.

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.5 Release Notes linked from the References section.

Users of ipa are advised to upgrade to these updated packages.

Solution

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.6 x86_64
• Red Hat Enterprise Linux Server - AUS 7.7 x86_64
• Red Hat Enterprise Linux Server - AUS 7.6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for IBM z Systems 7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.6 s390x
• Red Hat Enterprise Linux for Power, big endian 7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.6 ppc64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Enterprise Linux for Power, little endian 7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.6 ppc64le
• Red Hat Enterprise Linux Server - TUS 7.7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x
• Red Hat Enterprise Linux for ARM 64 7 aarch64
• Red Hat Enterprise Linux for Power 9 7 ppc64le
• Red Hat Enterprise Linux EUS Compute Node 7.7 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.6 x86_64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.7 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.6 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.6 x86_64
• Red Hat Enterprise Linux for IBM System z (Structure A) 7 s390x
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 ppc64le

Fixes

• BZ - 1378892 - host-find slowness caused by missing host attributes in index
• BZ - 1388135 - [RFE] limit the retro changelog to dns subtree.
• BZ - 1398594 - ipa topologysuffix-verify should only warn about maximum number of replication agreements.
• BZ - 1404236 - Web UI: Change "Host Based" and "Role Based" to "Host-Based" and "Role-Based"
• BZ - 1409786 - Second phase of --external-ca ipa-server-install setup fails when dirsrv is not running
• BZ - 1415162 - ipa-extdom-extop plugin can exhaust DS worker threads
• BZ - 1421869 - Unable to re-add broken AD trust - Unexpected Information received
• BZ - 1427798 - Use X509v3 Basic Constraints "CA:TRUE" instead of "CA:FALSE" IPA CA CSR
• BZ - 1449985 - Suggest CA installation command in KRA installation warning
• BZ - 1451576 - ipa cert-request failed to generate certificate from csr
• BZ - 1452086 - Pagination Size under Customization in IPA WebUI accepts negative values
• BZ - 1457876 - ipa-backup fails silently
• BZ - 1458169 - --force-join option is not mentioned in ipa-replica-install man page
• BZ - 1463186 - IPA shouldn't allow objectclass if not all in lower case
• BZ - 1464205 - NULL LDAP context in call to ldap_search_ext_s during search in cn=ad,cn=trusts,dc=example,dc=com
• BZ - 1467887 - iommu platform support for ipxe
• BZ - 1469246 - Replica install fails to configure IPA-specific temporary files/directories
• BZ - 1469480 - bind package is not automatically updated during ipa-server upgrade process
• BZ - 1470177 - Rebase IPA to latest 4.5.x version
• BZ - 1475238 - Use CommonNameToSANDefault in default profile (new installs only)
• BZ - 1477178 - [ipa-replica-install] - 406 Client Error: Failed to validate message: Incorrect number of results (0) searching forpublic key for host
• BZ - 1477243 - ipa help command returns traceback when no cache is present
• BZ - 1477367 - ipa-server-upgrade timeouts on wait_for_open ports expecting IPA services listening on IPv6 ports
• BZ - 1477531 - Incorrect attribute level rights (ipaallowedtoperform) of service object
• BZ - 1477703 - IPA upgrade fails for latest ipa package
• BZ - 1478322 - user-show command fails when sizelimit is configured to number <= number of entity which is user member of
• BZ - 1480102 - ipa-server-upgrade failes with "This entry already exists"
• BZ - 1482802 - Unable to set ca renewal master on replica
• BZ - 1484428 - Updating from RHEL 7.3 fails with Server-Cert not found (ipa-server-upgrade)
• BZ - 1484826 - FreeIPA/IdM installations which were upgraded from versions with 389 DS prior to 1.3.3.0 doesn't have whomai plugin enabled and thus startup of Web UI fails
• BZ - 1486283 - TypeError in renew_ca_cert prevents from swiching back to self-signed CA
• BZ - 1486286 - IPA failing to authenticate via password+OTP on RHEL7.4 with fips enabled
• BZ - 1493145 - ipa-replica-install might fail because of an already existing entry cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,$SUFFIX
• BZ - 1493150 - [RFE] set nsslapd-ignore-time-skew: on by default
• BZ - 1493531 - In case full PKINIT configuration is failing during server/replica install the error message should be more meaningful.
• BZ - 1496775 - Enterprise principals should be able to trigger a refresh of the trusted domain data in the KDC
• BZ - 1498168 - Error when trying to modify a PTR record
• BZ - 1498387 - 389-ds-base crashed as part of ipa-server-intall in ipa-uuid
• BZ - 1500218 - Replica installation at domain-level 0 fails against upgraded ipa-server
• BZ - 1502533 - Changing cert-find to go through the proxy instead of using the port 8080
• BZ - 1502663 - pkinit-status command fails after an upgrade from a pre-4.5 IPA
• BZ - 1503022 - ipa-getkeytab man page should have more details about consequences of krb5 key renewal
• BZ - 1506188 - server-del doesn't remove dns-server configuration from ldap
• BZ - 1509288 - IPA trust-add internal error (expected security.dom_sid got None)
• BZ - 1511019 - ipa-restore broken with python2
• BZ - 1511607 - ipa-backup does not backup Custodia keys and files
• BZ - 1512482 - kra install fails after ipa cert renewed
• BZ - 1520279 - ipa-server-trust-ad has missing dependencies with latest RHEL distro
• BZ - 1529444 - ObjectclassViolation seen while adding idview with domain-resolution-order option.
• BZ - 1540361 - ipa-advise for smartcards is out-of-date

CVEs

(none)

References

• https://access.redhat.com/documentation/en-US/red_hat_enterprise_linux/7/html/7.5_release_notes/index.html