Scientific Linux alert SLSA-2021:0860-1 (ipa)

From:
             
 
Bonnie King <bonniek@fnal.gov>
To:
             
 
scientific-linux-errata@listserv.fnal.gov
Subject:
             
 
Security ERRATA Important: ipa on SL7.x x86_64
Date:
             
 
Wed, 17 Mar 2021 14:29:59 -0000
Message-ID:
             
 
<20210317142959.494.43257@4d14c5bc2382>
Synopsis:          Moderate: ipa security and bug fix update
Advisory ID:       SLSA-2021:0860-1
Issue Date:        2021-03-16
CVE Numbers:       CVE-2020-11023
--

Security Fix(es):

* jquery: Passing HTML containing <option> elements to manipulation
methods  could result in untrusted code execution (CVE-2020-11023)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE

Bug Fix(es):

* cannot issue certs with multiple IP addresses corresponding to different
hosts

* CA-less install does not set required permissions on KDC certificate

* IdM Web UI shows users as disabled

* Authentication and login times are over several seconds due to unindexed
ipaExternalMember

* improve IPA PKI susbsystem detection by other means than a directory
presence, use pki-server subsystem-find

* IPA WebUI inaccessible after upgrading to SL 8.3 -  idoverride-
memberof.js missing
--

SL7
  x86_64
    ipa-client-4.6.8-5.el7_9.4.x86_64.rpm
    ipa-debuginfo-4.6.8-5.el7_9.4.x86_64.rpm
    ipa-server-4.6.8-5.el7_9.4.x86_64.rpm
    ipa-server-trust-ad-4.6.8-5.el7_9.4.x86_64.rpm
  noarch
    ipa-client-common-4.6.8-5.el7_9.4.noarch.rpm
    ipa-common-4.6.8-5.el7_9.4.noarch.rpm
    ipa-python-compat-4.6.8-5.el7_9.4.noarch.rpm
    python2-ipaclient-4.6.8-5.el7_9.4.noarch.rpm
    python2-ipalib-4.6.8-5.el7_9.4.noarch.rpm
    ipa-server-common-4.6.8-5.el7_9.4.noarch.rpm
    ipa-server-dns-4.6.8-5.el7_9.4.noarch.rpm
    python2-ipaserver-4.6.8-5.el7_9.4.noarch.rpm

- Scientific Linux Development Team