[ol8_appstream] ipa-selinux-4.9.13-21.0.2.module+el8.10.0+91065+f06407c0.3.noarch

Name:	ipa-selinux
Version:	4.9.13
Release:	21.0.2.module+el8.10.0+91065+f06407c0.3
Architecture:	noarch
Module:	idm:DL1:8100020261007070536:10
Group:	Unspecified
Size:	16381
License:	GPLv3+
RPM:	ipa-selinux-4.9.13-21.0.2.module+el8.10.0+91065+f06407c0.3.noarch.rpm
Source RPM:	ipa-4.9.13-21.0.2.module+el8.10.0+91065+f06407c0.3.src.rpm
Build Date:	Thu Oct 15 2026
Build Host:	build-ol8-x86_64.oracle.com
Vendor:	Oracle America
URL:	http://www.freeipa.org/
Summary:	FreeIPA SELinux policy
Description:	Custom SELinux policy module for FreeIPA

Changelog (Show File list) (Show related packages)

Thu Oct 15 2026 David Sloboda <david.x.sloboda@oracle.com> - 4.9.13-21.3.0.2
```
- Set IPAPLATFORM=rhel when build on Oracle Linux [Orabug: 29516674]
```

Mon Oct 05 2026 Prasad Kalanke <pkalanke@redhat.com> - 4.9.13-21.3

- Updated the application() function in install/migration/migration.py to resolve the error.
- CVE-2026-73197 ipa: FreeIPA: Unauthenticated DoS in /ipa/migration/migration.py via Unbounded Request Body Read
  Resolves: RHEL-240819

Thu Oct 01 2026 Prasad Kalanke <pkalanke@redhat.com> - 4.9.13-21.2

- Fix ipatests for kdcproxy after CVE-2025-59088 fix
  Resolves: RHEL-129966
- CVE-2026-18147 idm:DL1/ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL
  Resolves: RHEL-218850
- CVE-2026-18147 idm:client/ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL
  Resolves: RHEL-218856
- CVE-2026-73198 ipa: FreeIPA: Unauthenticated DoS in /ipa/i18n_messages via Unbounded Request Body Read
  Resolves: RHEL-240798
- CVE-2026-73197 ipa: FreeIPA: Unauthenticated DoS in /ipa/migration/migration.py via Unbounded Request Body Read
  Resolves: RHEL-240819
- CVE-2026-11861 ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships
  Resolves: RHEL-240840
- CVE-2026-13097 ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore
  Resolves: RHEL-240905
- CVE-2026-76578 idm:DL1/ipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI
  Resolves: RHEL-245481
- CVE-2026-19550 ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes
  Resolves: RHEL-245621
- CVE-2026-79678 idm:DL1/ipa: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service
  Resolves: RHEL-255682

Fri Sep 11 2026 Prasad Kalanke <pkalanke@redhat.com> - 4.9.13-21.1

- Fix ipatests for kdcproxy after CVE-2025-59088 fix
  Resolves: RHEL-129966
- CVE-2026-18147 idm:DL1/ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL
  Resolves: RHEL-218850
- CVE-2026-18147 idm:client/ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL
  Resolves: RHEL-218856
- CVE-2026-73198 ipa: FreeIPA: Unauthenticated DoS in /ipa/i18n_messages via Unbounded Request Body Read
  Resolves: RHEL-240798
- CVE-2026-73197 ipa: FreeIPA: Unauthenticated DoS in /ipa/migration/migration.py via Unbounded Request Body Read
  Resolves: RHEL-240819
- CVE-2026-11861 ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships
  Resolves: RHEL-240840
- CVE-2026-13097 ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore
  Resolves: RHEL-240905
- CVE-2026-76578 idm:DL1/ipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI
  Resolves: RHEL-245481
- CVE-2026-19550 ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes
  Resolves: RHEL-245621
- CVE-2026-79678 idm:DL1/ipa: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service
  Resolves: RHEL-255682

Fri Jan 30 2026 Rafael Jeffman <rjeffman@redhat.com> - 4.9.13-21
```
- Fix memory leaks in IPA plugins
  Resolves: RHEL-145410
```

Thu Sep 11 2025 Rafael Jeffman <rjeffman@redhat.com> - 4.9.13-20

- Refactor ipatests for unique krbcanonicalname
  Resolves: RHEL-110061

Thu Sep 11 2025 Rafael Jeffman <rjeffman@redhat.com> - 4.9.13-19

- Enforce uniqueness across krbprincipalname and krbcanonicalname
  ipa-kdb: enforce PAC presence on TGT for TGS-REQ
  ipatests: extend test for unique krbcanonicalname
  Resolves: RHEL-110061

Tue Jun 03 2025 Rafael Jeffman <rjeffman@redhat.com> - 4.9.13-18

- Set krbCanonicalName admin@REALM on the admin user
  Resolves: RHEL-89895

Mon May 19 2025 Rafael Jeffman <rjeffman@redhat.com> - 4.9.13-17

- kdb: keeep ipadb_get_connection() from succeding with null LDAP context
  Resolves: RHEL-58453

Mon Mar 31 2025 Rafael Jeffman <rjeffman@redhat.com> - 4.9.13-16

- Add a- heck into ipa-cert-fix tool to avoid updating certs if CA is close to expire
  Resolves: RHEL-4941
- Fix rpminspect's 'patches' warnings
  Resolves: RHEL-22497