ELSA-2026-83460

Описание

bind-dyndb-ldap [11.6-6]

• Fix rpminspect warnings Resolves: RHEL-22497

custodia [0.6.0-3]

• Require platform-python-setuptools instead of python3-setuptools
• Resolves: rhbz#1650508

ipa [4.9.13-21.3.0.2]

• Set IPAPLATFORM=rhel when build on Oracle Linux [Orabug: 29516674]

[4.9.13-21.3]

• Updated the application() function in install/migration/migration.py to resolve the error.
• CVE-2026-73197 ipa: FreeIPA: Unauthenticated DoS in /ipa/migration/migration.py via Unbounded Request Body Read Resolves: RHEL-240819

[4.9.13-21.2]

• Fix ipatests for kdcproxy after CVE-2025-59088 fix Resolves: RHEL-129966
• CVE-2026-18147 idm:DL1/ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL Resolves: RHEL-218850
• CVE-2026-18147 idm:client/ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL Resolves: RHEL-218856
• CVE-2026-73198 ipa: FreeIPA: Unauthenticated DoS in /ipa/i18n_messages via Unbounded Request Body Read Resolves: RHEL-240798
• CVE-2026-73197 ipa: FreeIPA: Unauthenticated DoS in /ipa/migration/migration.py via Unbounded Request Body Read Resolves: RHEL-240819
• CVE-2026-11861 ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships Resolves: RHEL-240840
• CVE-2026-13097 ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore Resolves: RHEL-240905
• CVE-2026-76578 idm:DL1/ipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI Resolves: RHEL-245481
• CVE-2026-19550 ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes Resolves: RHEL-245621
• CVE-2026-79678 idm:DL1/ipa: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service Resolves: RHEL-255682

[4.9.13-21.1]

• Fix ipatests for kdcproxy after CVE-2025-59088 fix Resolves: RHEL-129966
• CVE-2026-18147 idm:DL1/ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL Resolves: RHEL-218850
• CVE-2026-18147 idm:client/ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL Resolves: RHEL-218856
• CVE-2026-73198 ipa: FreeIPA: Unauthenticated DoS in /ipa/i18n_messages via Unbounded Request Body Read Resolves: RHEL-240798
• CVE-2026-73197 ipa: FreeIPA: Unauthenticated DoS in /ipa/migration/migration.py via Unbounded Request Body Read Resolves: RHEL-240819
• CVE-2026-11861 ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships Resolves: RHEL-240840
• CVE-2026-13097 ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore Resolves: RHEL-240905
• CVE-2026-76578 idm:DL1/ipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI Resolves: RHEL-245481
• CVE-2026-19550 ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes Resolves: RHEL-245621
• CVE-2026-79678 idm:DL1/ipa: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service Resolves: RHEL-255682

ipa-healthcheck [0.12-6]

• Don't rely on order in trust roles (RHEL-99487)

opendnssec [2.1.7-2]

• Don't creat /var/run/opendnssec directory
• Resolves: RHEL-12163

python-jwcrypto [0.5.0-2]

• Address potential DoS with high compression ratio Resolves: RHEL-28697
• Limit number of iterations for PBES Resolves: RHEL-23036 RHEL-23037

python-kdcproxy [0.4-5.2]

• Use DNS discovery for declared realms only (CVE-2025-59088) Resolves: RHEL-113657
• Fix DoS vulnerability based on unbounded TCP buffering (CVE-2025-59089) Resolves: RHEL-113664

python-qrcode [5.3-1]

• Resolves: RHEL-15090 Generation of image file fails with Python 3

python-yubico [1.3.2-9.1]

• Rebuilt to fix NVR issue (#2097803)

pyusb [1.0.0-9.1]

• Rebuilt to fix the NVR issue (#2094880)

slapi-nis [0.60.0-4]

• Ignore updates from non-tracked subtrees during modify/modrdn/update to avoid deadlocks with retro changelog
• Resolves: RHEL-5134

softhsm [2.6.0-5]

• Install prever devel package requirements for new negative option patch Related: RHBZ#1857272