RHSA-2021:1846 - Security Advisory

Topic

An update for the idm:DL1 and idm:client modules is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments.

Security Fix(es):

• jquery: Passing HTML containing <option> elements to manipulation methods could result in untrusted code execution (CVE-2020-11023)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.4 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux for x86_64 8 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.8 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.4 x86_64
• Red Hat Enterprise Linux Server - AUS 8.6 x86_64
• Red Hat Enterprise Linux Server - AUS 8.4 x86_64
• Red Hat Enterprise Linux for IBM z Systems 8 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.8 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.4 s390x
• Red Hat Enterprise Linux for Power, little endian 8 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.8 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.6 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.4 ppc64le
• Red Hat Enterprise Linux Server - TUS 8.8 x86_64
• Red Hat Enterprise Linux Server - TUS 8.6 x86_64
• Red Hat Enterprise Linux Server - TUS 8.4 x86_64
• Red Hat Enterprise Linux for ARM 64 8 aarch64
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.8 aarch64
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.6 aarch64
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.4 aarch64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.8 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.6 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.4 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.8 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.4 x86_64

Fixes

• BZ - 871208 - ipa sudorule-add-user should accept external users
• BZ - 1340463 - [RFE] Implement pam_pwquality featureset in IPA password policies
• BZ - 1357495 - ipa command provides stack trace when provided with single hypen commands
• BZ - 1484088 - [RFE]: Able to browse different links from IPA web gui in new tabs
• BZ - 1542737 - Incorrect certs are being updated with "ipa-certupdate"
• BZ - 1544379 - ipa-client-install changes system wide ssh configuration
• BZ - 1660877 - kinit is failing due to overflow in Root CA certificate's timestamp
• BZ - 1779981 - ipa-cert-fix warning message should use commercial name for the product.
• BZ - 1780328 - ipa-healthcheck - Mention that the default output format is JSON.
• BZ - 1780510 - Source 'ipahealthcheck.ipa.topology' not found is displayed when ipactl service is stopped
• BZ - 1780782 - ipa-cert-fix tool fails when the Dogtag CA SSL CSR is missing from CS.cfg
• BZ - 1784657 - Unlock user accounts after a password reset and replicate that unlock to all IdM servers
• BZ - 1809215 - Man page has incorrect examples; log location for healthcheck tool
• BZ - 1810148 - ipa-server-certinstall raises exception when installing IPA-issued web server cert
• BZ - 1812871 - Intermittent IdM Client Registration Failures
• BZ - 1824193 - Add Directory Server Healthchecks from lib389
• BZ - 1850004 - CVE-2020-11023 jquery: Passing HTML containing <option> elements to manipulation methods could result in untrusted code execution
• BZ - 1851835 - [RFE] IdM short-term certificates ACME provider
• BZ - 1857272 - negative option for token.mechanism not working correctly
• BZ - 1860129 - ipa trust-add fails when FIPS enabled
• BZ - 1866558 - ipa-healthcheck --input-file returns 1 on exit
• BZ - 1872603 - KRA Transport and Storage Certificates do not renew
• BZ - 1875001 - It is not possible to edit KDC database when the FreeIPA server is running
• BZ - 1882340 - nsslapd-db-locks patching no longer works
• BZ - 1891056 - ipa-kdb: support subordinate/superior UPN suffixes
• BZ - 1891505 - ipa-healthcheck returns msg": "{sssctl} {key} reports mismatch: sssd domains {sssd_domains} trust domains {trust_domains}"
• BZ - 1891735 - [Rebase] Rebase bind-dyndb-ldap to the recent upstream release
• BZ - 1891741 - [Rebase] Rebase slapi-nis to recent upstream release
• BZ - 1891832 - [Rebase] Rebase FreeIPA to a recent upstream release
• BZ - 1891850 - [Rebase] Rebase ipa-healthcheck to 0.7 upstream release
• BZ - 1894800 - IPA WebUI inaccessible after upgrading to RHEL 8.3.- idoverride-memberof.js missing
• BZ - 1901068 - Traceback while doing ipa-backup
• BZ - 1902173 - Uninstallation of IPA server with KRA installed displays 'ERROR: subprocess.CalledProcessError:'
• BZ - 1902727 - ipa-acme-manage enable fails after upgrade
• BZ - 1903025 - test failure in test_acme.py::TestACME::test_third_party_certs
• BZ - 1904484 - [Rebase] Rebase opendnssec to 2.1.7
• BZ - 1904612 - bind-dyndb-ldap: Rebased bind modifies so versions
• BZ - 1905919 - ipa-server-upgrade fails with traceback "exception: KeyError: 'DOMAIN'"
• BZ - 1909876 - ipa uninstall fails when dns not installed
• BZ - 1912845 - ipa-certupdate drops profile from the caSigningCert tracking
• BZ - 1922955 - Resubmitting KDC cert fails with internal server error
• BZ - 1923900 - Samba on IdM member failure
• BZ - 1924026 - Fix upstream test test_trust.py::test_subordinate_suffix
• BZ - 1924501 - ipa-client-install: Error trying to clean keytab: /usr/sbin/ipa-rmkeytab returned 7
• BZ - 1924812 - Fix upstream test test_smb.py::TestSMB::test_authentication_with_smb_cifs_principal_alias
• BZ - 1925410 - Cannot delete sudocmd with typo error e.g. "/usr/sbin/reboot."
• BZ - 1926699 - avc denial for gpg-agent with systemd-run
• BZ - 1926910 - ipa cert-remove-hold <invalid_cert_id> returns an incorrect error message
• BZ - 1928900 - Support new baseURL config option for ACME
• BZ - 1930426 - IPA krb5kdc crash possible doublefree ipadb_mspac_struct_free finish_process_as_req
• BZ - 1932289 - Sync ipatests from upstream to RHEL packages for FreeIPA 4.9 branch
• BZ - 1939371 - ipa-client-install displays false message 'sudo binary does not seem to be present on this system'

CVEs

• CVE-2020-11023

References

• https://access.redhat.com/security/updates/classification/#moderate
• https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.4_release_notes/