RHBA-2018:3187 - Bug Fix Advisory

Topic

An update for ipa is now available for Red Hat Enterprise Linux 7.

Description

Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments.

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.6 Release Notes linked from the References section.

Users of ipa are advised to upgrade to these updated packages.

Solution

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for IBM z Systems 7 s390x
• Red Hat Enterprise Linux for Power, big endian 7 ppc64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Enterprise Linux for Power, little endian 7 ppc64le
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x
• Red Hat Enterprise Linux for ARM 64 7 aarch64
• Red Hat Enterprise Linux for Power 9 7 ppc64le
• Red Hat Enterprise Linux for IBM System z (Structure A) 7 s390x
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 ppc64le

Fixes

• BZ - 1234219 - [WebUI] Error message could be better while adding idrange with untrusted domain name.
• BZ - 1274488 - ipa-client-install should use previously entered username when performing setup validation
• BZ - 1289487 - Priority field missing in Password Policy detail tab
• BZ - 1339129 - ipa vault-archive overwrites an existing value without warning
• BZ - 1368345 - Replace ERROR: cannot connect to 'http://localhost:8888/ipa/json': [Errno 111] Connection refused with 'IPA is not configured on this system'
• BZ - 1381535 - ipa config-mod returns "Configured size limit exceeded" while modifying searchrecordslimit value.
• BZ - 1434924 - ipa-restore fails when umask is set to 0027
• BZ - 1441262 - ipa group-del gives ipa: ERROR: Insufficient access: but still deletes group
• BZ - 1452081 - Suggest user to install libyubikey package instead of traceback
• BZ - 1458183 - Users can delete their last active OTP token
• BZ - 1470916 - ipa client pointing to replica shows KDC has no support for encryption type
• BZ - 1478366 - Crash noticed during IPA upgrade process due to ipa package.
• BZ - 1480502 - ipa server uninstall with -v option displays "IOError: [Errno 9] Bad file descriptor Logged from file ipautil.py, line 442"
• BZ - 1481936 - Limit number of times the DNS response for the ipa-server A and AAAA records are done during uninstallation.
• BZ - 1485429 - domain resolution order field in Identity->ID Views->Settings tab missing in WebUI
• BZ - 1485851 - ipa param-find: command displays internal error
• BZ - 1494198 - ipa-replica-manage re-initialize TypeError: 'NoneType' object does not support item assignment
• BZ - 1504565 - API schema generated by server doesn't follow language requested by client.
• BZ - 1505925 - kdc segfault in openldap libs when ipa-server is installed and custom pkinit is configured
• BZ - 1508498 - Authn/TOTP defined users periodically prompt for just password credentials to access resources
• BZ - 1513041 - ipa-restore does not enable/start oddjobd
• BZ - 1515314 - ipa-replica-install fails with PIN error [ CA-less environment ]
• BZ - 1515374 - Custodia keys are not removed on uninstall
• BZ - 1518157 - Clarify the need to restart services in ipa-server-certinstall(1)
• BZ - 1519723 - admins group is not including all permissions of Role "User Administrator"
• BZ - 1527020 - nsslapd-sasl-max-buffer-size is hardcoded to '2097152' during install even if another value was provided in an LDIF ( --dirsrv-config-file )
• BZ - 1534726 - IPA 'Generate OTP' option in web gui does not show OTP code when no reverse zone is managed
• BZ - 1544679 - OTP and Radius Authentication does not work in FIPS mode
• BZ - 1547641 - ipa: Please log something after restarting the KDC
• BZ - 1547995 - CRL url on replicas gets incorrectly redirected
• BZ - 1549187 - IdM servers:/usr/share/ipa/html/ca.crt does not include the complete chain
• BZ - 1553594 - ldappasswd cause the IPA embedded Directory server to SIGSEGV
• BZ - 1565633 - nsds5ReplicaReleaseTimeout should be set by default.
• BZ - 1568748 - Allow hosts to delete their own services
• BZ - 1576133 - Radius Proxy OTP Auth in IPA is not failing over to the second server in a radius-proxy
• BZ - 1577108 - Improve Custodia client and key distribution handling
• BZ - 1577805 - 4.5.0 -> 4.5.4 upgrade breaks in ipa-server-upgrade: No such file or directory: '/var/lib/pki/pki-tomcat/conf/ca/CS.cfg'
• BZ - 1590647 - ldapmodify userPassword reflects on krblastpwdchange on RHEL6 but not RHEL7
• BZ - 1591647 - Increase WSGI worker process count
• BZ - 1591824 - Installation of replica against a specific master
• BZ - 1594141 - Replication races in DogtagInstance.setup_admin
• BZ - 1594142 - SRV lookup doesn't correctly sort results
• BZ - 1596168 - ipa help topics displays 'ipa: ERROR: an internal error has occurred'
• BZ - 1598044 - plugable.py:491:bootstrap:SystemEncodingError: System encoding must be UTF-8, 'ANSI_X3.4-1968' is not supported.
• BZ - 1598117 - client uninstall fails when installed using non-existing hostname
• BZ - 1598662 - Replica installation fails with connection refused error
• BZ - 1600074 - ipa-server-upgrade displays 'DN: cn=Schema Compatibility,cn=plugins,cn=config does not exists or haven't been updated'
• BZ - 1600525 - ipa-client-install --uninstall fails to uninstall client.
• BZ - 1603444 - ipa-server-install script is failing when using the "--no-dnssec-validation" parameter combined with the "--forwarder"
• BZ - 1603514 - Replica install fails with "Certificate issuance failed (CA_REJECTED)" - ACIError
• BZ - 1607616 - Traceback in messages file during ipa-server-install: File "/usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit", line 541, in <module>#012
• BZ - 1608783 - ipa trust-add fails in FIPS mode.
• BZ - 1609882 - ipaserver/plugins/cert.py: Add reason to raise of errors.NotFound
• BZ - 1622168 - ipa-otpd: fix potential double-free and infinite loop in queue code
• BZ - 1623112 - ipa-replica-install defines nsds5replicabinddngroup before the group contains the DN of the replication manager
• BZ - 1623113 - Replica install: certmonger sometimes fails
• BZ - 1623486 - PKINIT configuration did not succeed message is received during Replica-install
• BZ - 1624755 - Re-installing replica on the same system displays 'WARNING: cannot check if port 443 is already configured'
• BZ - 1630361 - PKINIT fails in FIPS mode

CVEs

(none)

References

• https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.6_release_notes/index