RHBA-2019:2152 - Bug Fix Advisory

Topic

An update for 389-ds-base is now available for Red Hat Enterprise Linux 7.

Description

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section.

Users of 389-ds-base are advised to upgrade to these updated packages.

Solution

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for IBM z Systems 7 s390x
• Red Hat Enterprise Linux for Power, big endian 7 ppc64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Enterprise Linux for Power, little endian 7 ppc64le
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 ppc64le

Fixes

• BZ - 1417340 - entry cache is not cleaned up if an operation is aborted
• BZ - 1451460 - error messages during ldif2db after enabling encryption on an attribute
• BZ - 1466441 - ns-slapd: segfault during server shutdown while there are cleanAllRuv tasks
• BZ - 1518320 - ns-slapd: crash in entrycache_add_int
• BZ - 1542469 - Why does the mep_origination entry toggle from tombstone/not_tombstone?
• BZ - 1561769 - [RFE] revise the "transient error" message in a replication agreement's last update status
• BZ - 1563999 - Is it possible for Directory server to reject the current password only?
• BZ - 1589144 - shadowWarning is not generated if passwordWarning is lower than 86400 seconds (1 day).
• BZ - 1600631 - In repicated topology a single-valued attribute can diverge
• BZ - 1601241 - ns-slapd - Crash when using bak2db.pl to restore a single database.
• BZ - 1602001 - cannot add cenotaph in read only consumer
• BZ - 1603140 - Export produces a non-importable ldif file.
• BZ - 1615155 - extended search fails to match entries
• BZ - 1623935 - upgrade of 389-ds-base could remove replication agreements.
• BZ - 1626375 - on-line re-initialization hangs
• BZ - 1627846 - Contention on virtual attribute lookup
• BZ - 1629055 - ds-replcheck unreliable, showing false positives
• BZ - 1630513 - Customer requesting -y option for ds-replcheck
• BZ - 1633488 - fixup-memberof.pl -D cn=<> -w - -b <> -P LDAP fails with ldap_start_tls error
• BZ - 1637439 - Message: "CRIT - list_candidates - NULL idl was recieved from filter_candidates_ext." should not be critical.
• BZ - 1639192 - Request to add passwordSendExpiringTime in password policy objectclass
• BZ - 1642838 - after certain failed import operation, impossible to replay an import operation.
• BZ - 1643587 - default of "nsslapd-errorlog-maxlogsperdir: 1" causing huge log files
• BZ - 1643772 - ds-replcheck should validate suffix exists and it's replicated.
• BZ - 1645359 - Rebase 389-ds-base in RHEL 7.7 to 1.3.9
• BZ - 1647133 - Log warn instead of ERR when aci target does not exist.
• BZ - 1648922 - during MODRDN referential integrity can fail erronously while updating large groups
• BZ - 1651279 - The dirsrv user is no longer created with uid 389
• BZ - 1652984 - Subtree password policy overrides a user-defined password policy.
• BZ - 1653163 - certmap fails when Issuer DN has comma in name
• BZ - 1663829 - import task should not be deleted after import finishes to be able to query the status.
• BZ - 1665752 - Bug 1598186 is still reproducible with 389-ds-base-1.3.8.4-18.
• BZ - 1673472 - the warning about skew time could last forever.
• BZ - 1680245 - Error in memberof-plugin cause failures in ipa group-mod
• BZ - 1689313 - OPERATIONS ERROR when trying to delete a group with automember members
• BZ - 1695014 - Clarify the ability to change the NOFILE limit
• BZ - 1701092 - segfault when using pam passthru and addn plugins together
• BZ - 1702740 - ns-slapd craches on IPA Servers throughout the customer's topology
• BZ - 1705125 - ipa-replica-install with 389-ds-base-1.3.9.1-5.el7
• BZ - 1708094 - ds-replcheck reports data inconsistency if attribute has matching entries but in different order
• BZ - 1708215 - maxlogsperdir accepting negative values
• BZ - 1710848 - ACI's with IPv4 and IPv6 bind rules do not work for IPv6 clients
• BZ - 1710961 - During MODRDN, memberof may silently fails to update a member
• BZ - 1713361 - Update defaults.inf
• BZ - 1715091 - ds-replcheck does not always print a Result summary

CVEs

(none)

References

• https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.7_release_notes/index