[ol8_appstream] ipa-server-4.9.13-21.0.2.module+el8.10.0+91065+f06407c0.3.aarch64

Name:	ipa-server
Version:	4.9.13
Release:	21.0.2.module+el8.10.0+91065+f06407c0.3
Architecture:	aarch64
Module:	idm:DL1:8100020261007070536:10
Group:	Unspecified
Size:	1959602
License:	GPLv3+
RPM:	ipa-server-4.9.13-21.0.2.module+el8.10.0+91065+f06407c0.3.aarch64.rpm
Source RPM:	ipa-4.9.13-21.0.2.module+el8.10.0+91065+f06407c0.3.src.rpm
Build Date:	Thu Oct 15 2026
Build Host:	build-ol8-aarch64.oracle.com
Vendor:	Oracle America
URL:	http://www.freeipa.org/
Summary:	The IPA authentication server
Description:	IPA is an integrated solution to provide centrally managed Identity (users, hosts, services), Authentication (SSO, 2FA), and Authorization (host access control, SELinux user roles, services). The solution provides features for further integration with Linux based clients (SUDO, automount) and integration with Active Directory based infrastructures (Trusts). If you are installing an IPA server, you need to install this package.

Changelog (Show File list) (Show related packages)

Thu Oct 15 2026 David Sloboda <david.x.sloboda@oracle.com> - 4.9.13-21.3.0.2
```
- Set IPAPLATFORM=rhel when build on Oracle Linux [Orabug: 29516674]
```

Mon Oct 05 2026 Prasad Kalanke <pkalanke@redhat.com> - 4.9.13-21.3

- Updated the application() function in install/migration/migration.py to resolve the error.
- CVE-2026-73197 ipa: FreeIPA: Unauthenticated DoS in /ipa/migration/migration.py via Unbounded Request Body Read
  Resolves: RHEL-240819

Thu Oct 01 2026 Prasad Kalanke <pkalanke@redhat.com> - 4.9.13-21.2

- Fix ipatests for kdcproxy after CVE-2025-59088 fix
  Resolves: RHEL-129966
- CVE-2026-18147 idm:DL1/ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL
  Resolves: RHEL-218850
- CVE-2026-18147 idm:client/ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL
  Resolves: RHEL-218856
- CVE-2026-73198 ipa: FreeIPA: Unauthenticated DoS in /ipa/i18n_messages via Unbounded Request Body Read
  Resolves: RHEL-240798
- CVE-2026-73197 ipa: FreeIPA: Unauthenticated DoS in /ipa/migration/migration.py via Unbounded Request Body Read
  Resolves: RHEL-240819
- CVE-2026-11861 ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships
  Resolves: RHEL-240840
- CVE-2026-13097 ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore
  Resolves: RHEL-240905
- CVE-2026-76578 idm:DL1/ipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI
  Resolves: RHEL-245481
- CVE-2026-19550 ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes
  Resolves: RHEL-245621
- CVE-2026-79678 idm:DL1/ipa: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service
  Resolves: RHEL-255682

Fri Sep 11 2026 Prasad Kalanke <pkalanke@redhat.com> - 4.9.13-21.1

- Fix ipatests for kdcproxy after CVE-2025-59088 fix
  Resolves: RHEL-129966
- CVE-2026-18147 idm:DL1/ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL
  Resolves: RHEL-218850
- CVE-2026-18147 idm:client/ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL
  Resolves: RHEL-218856
- CVE-2026-73198 ipa: FreeIPA: Unauthenticated DoS in /ipa/i18n_messages via Unbounded Request Body Read
  Resolves: RHEL-240798
- CVE-2026-73197 ipa: FreeIPA: Unauthenticated DoS in /ipa/migration/migration.py via Unbounded Request Body Read
  Resolves: RHEL-240819
- CVE-2026-11861 ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships
  Resolves: RHEL-240840
- CVE-2026-13097 ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore
  Resolves: RHEL-240905
- CVE-2026-76578 idm:DL1/ipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI
  Resolves: RHEL-245481
- CVE-2026-19550 ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes
  Resolves: RHEL-245621
- CVE-2026-79678 idm:DL1/ipa: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service
  Resolves: RHEL-255682

Fri Jan 30 2026 Rafael Jeffman <rjeffman@redhat.com> - 4.9.13-21
```
- Fix memory leaks in IPA plugins
  Resolves: RHEL-145410
```

Thu Sep 11 2025 Rafael Jeffman <rjeffman@redhat.com> - 4.9.13-20

- Refactor ipatests for unique krbcanonicalname
  Resolves: RHEL-110061

Thu Sep 11 2025 Rafael Jeffman <rjeffman@redhat.com> - 4.9.13-19

- Enforce uniqueness across krbprincipalname and krbcanonicalname
  ipa-kdb: enforce PAC presence on TGT for TGS-REQ
  ipatests: extend test for unique krbcanonicalname
  Resolves: RHEL-110061

Tue Jun 03 2025 Rafael Jeffman <rjeffman@redhat.com> - 4.9.13-18

- Set krbCanonicalName admin@REALM on the admin user
  Resolves: RHEL-89895

Mon May 19 2025 Rafael Jeffman <rjeffman@redhat.com> - 4.9.13-17

- kdb: keeep ipadb_get_connection() from succeding with null LDAP context
  Resolves: RHEL-58453

Mon Mar 31 2025 Rafael Jeffman <rjeffman@redhat.com> - 4.9.13-16

- Add a- heck into ipa-cert-fix tool to avoid updating certs if CA is close to expire
  Resolves: RHEL-4941
- Fix rpminspect's 'patches' warnings
  Resolves: RHEL-22497