RHBA-2019:0179 - Bug Fix Advisory

Topic

Updated 389-ds-base packages that fix several bugs are now available for Red Hat Enterprise Linux 7.

Description

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

This update fixes the following bugs:

• During a total initialization, Directory Server retrieves the top suffix entry. Previously, the server assumed that the database ID of the suffix entry is "1". If the ID was different, the server failed to prepare the list of entries and the initialization was unresponsive. With this update, Directory Server provides the correct ID of the suffix to the routine that prepares the list of entries. As a result, a total initialization works successfully if the database ID of the suffix entry is different from "1". (BZ#1645197)
• Previously, if password synchronization was enabled and a user changed a password in Directory Server, the server did not set the pwdLastSet attribute. As a consequence, Active Directory (AD) still forced the user to update the password. With this update, Directory Server now updates pwdLastSet in the mentioned scenario. As a result. AD does not force the user to change the password again. (BZ#1653820)
• When a user renames an entry in Directory Server, the Referential Integrity plug-in updates groups that refer to the renamed entry. Previously, if a group with an entry that should be renamed had more than 128 members, some of the member's distinguished name (DN) contained escaped characters, and the renamed entry was not the last member of the group, the plug-in returned an incorrect return code. As a consequence, the plug-in returned a failure and the renamed operation failed without logging an error. With this update, the Referential Integrity plug-in returns the correct return code. As a result, the plug-in renames entries correctly. (BZ#1659510)
• Previously, Directory Server failed to compare the issuer distinguished name (DN) from a certificate and the issuer DN set in the /etc/dirsrv/slapd-<instance_name>/certmap.conf file, if the DN contained a character that must be escaped, such as a comma. As a consequence, binding to Directory Server using certificate-based authentication failed. This update fixes the problem. As a result, using a DN with escaped characters in the certificate mapping file works as expected. (BZ#1660120)

Users of 389-ds-base are advised to upgrade to these updated packages, which fix these bugs. After installing this update, the 389 server service will be restarted automatically.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.6 x86_64
• Red Hat Enterprise Linux Server - AUS 7.6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for IBM z Systems 7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.6 s390x
• Red Hat Enterprise Linux for Power, big endian 7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.6 ppc64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Enterprise Linux for Power, little endian 7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.6 ppc64le
• Red Hat Enterprise Linux Server - TUS 7.6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x
• Red Hat Enterprise Linux for ARM 64 7 aarch64
• Red Hat Enterprise Linux for Power 9 7 ppc64le
• Red Hat Enterprise Linux EUS Compute Node 7.6 x86_64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.6 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.6 x86_64
• Red Hat Enterprise Linux for IBM System z (Structure A) 7 s390x
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 ppc64le

Fixes

• BZ - 1645197 - on-line re-initialization hangs [rhel-7.6.z]
• BZ - 1659510 - during MODRDN referential integrity can fail erronously while updating large groups [rhel-7.6.z]
• BZ - 1660120 - certmap fails when Issuer DN has comma in name [rhel-7.6.z]

CVEs

(none)

References

(none)