ELSA-2026-72279

ELSA-2026-72279 - ipa security, bug fix, and enhancement update

Type:SECURITY
Impact:CRITICAL
Release Date:2026-09-28

Description


[4.13.4-1.0.1]
- Set IPAPLATFORM=rhel when build on Oracle Linux [Orabug: 29516674]
- Add bind to ipa-server-common Requires [Orabug: 36518596]

[4.13.4-1]
- Resolves: RHEL-248199 CVE-2026-79678 ipa: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service
- Resolves: RHEL-245626 CVE-2026-19550 ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes [rhel-10.2.z]
- Resolves: RHEL-245473 CVE-2026-76578 ipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI
- Resolves: RHEL-240909 CVE-2026-13097 ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore [rhel-10.2.z]
- Resolves: RHEL-240842 CVE-2026-11861 ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships [rhel-10.2.z]
- Resolves: RHEL-240821 CVE-2026-73197 ipa: FreeIPA: Unauthenticated DoS in /ipa/migration/migration.py via Unbounded Request Body Read [rhel-10.2.z]
- Resolves: RHEL-240800 CVE-2026-73198 ipa: FreeIPA: Unauthenticated DoS in /ipa/i18n_messages via Unbounded Request Body Read [rhel-10.2.z]
- Resolves: RHEL-240768 ipa-migrate tool is renaming host records & host info in automount information [rhel-10.2.z]
- Resolves: RHEL-238676 ipa-migrate: require Replication Administrator privilege [rhel-10.2.z]
- Resolves: RHEL-238673 ipa-epn: drop_privileges method is mixing uid and gid [rhel-10.2.z]
- Resolves: RHEL-238526 ipa env: support only simple * wildcard [rhel-10.2.z]
- Resolves: RHEL-238522 host-mod: handle the password attribute when set with --setattr userpassword= [rhel-10.2.z]
- Resolves: RHEL-238518 ipa-otptoken-import hardening [rhel-10.2.z]
- Resolves: RHEL-238516 Remove NetBIOS dependencies in Identity Manager [rhel-10.2.z]
- Resolves: RHEL-238510 WebUI Hardening [rhel-10.2.z]
- Resolves: RHEL-218853 CVE-2026-18147 ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL
- Resolves: RHEL-173375 [Cursor Automated] Include latest fixes in python3-ipatests package [RHEL10.2]

[4.13.1-3.2]
- Resolves: RHEL-168516 TestIPAMigrationProdMode tests are missing

[4.13.1-3.1]
- Resolves: RHEL-155027 Adding a group with 32Bit Idrange fails
- Resolves: RHEL-153145 IdM password policy Min lifetime is not enforced when high minlife is set
- Resolves: RHEL-166864 Include latest fixes in python3-ipatests package


Related CVEs


CVE-2026-11861
CVE-2026-13097
CVE-2026-18147
CVE-2026-19550
CVE-2026-73197
CVE-2026-73198
CVE-2026-76578
CVE-2026-79678

Updated Packages


Release/ArchitectureFilenamesha256Superseded By AdvisoryChannel Label
Oracle Linux 10 (aarch64) ipa-4.13.4-1.0.1.el10_2.src.rpm1d05c67ba6d2480decab9244851a4fe3defbace6b93c706281f1f85883925caf-ol10_aarch64_appstream
ipa-4.13.4-1.0.1.el10_2.src.rpm1d05c67ba6d2480decab9244851a4fe3defbace6b93c706281f1f85883925caf-ol10_aarch64_codeready_builder
ipa-client-4.13.4-1.0.1.el10_2.aarch64.rpm6e08ca1d6e21c9d4e6f34c2bd6080c1c36687e0d4069339b3c19d0f7c65b4e40-ol10_aarch64_appstream
ipa-client-common-4.13.4-1.0.1.el10_2.noarch.rpme95a77a48f377766c8c81c3e219d20819055834a4a9740743549b6d60784e4f7-ol10_aarch64_appstream
ipa-client-encrypted-dns-4.13.4-1.0.1.el10_2.aarch64.rpm19a62fb123620a1fb156c5259437e51f8df326aaeeae51863070cb3e0e0345d4-ol10_aarch64_appstream
ipa-client-epn-4.13.4-1.0.1.el10_2.aarch64.rpm1fb6be9f3b3d8fc0a810347e1a1bb57f0ee1a870638f940adfbfb96a8cd35b0e-ol10_aarch64_appstream
ipa-client-samba-4.13.4-1.0.1.el10_2.aarch64.rpmed2568c14661c5486adf9930f320f5c1c80a8bba1db1d683748bb928b39fccfe-ol10_aarch64_appstream
ipa-common-4.13.4-1.0.1.el10_2.noarch.rpmc674e8f50e6b523bc846b1e569fca5193a875552aba79a981a3b42b2a24ebacf-ol10_aarch64_appstream
ipa-selinux-4.13.4-1.0.1.el10_2.noarch.rpm5edd9e9bc2e506e5cb8de4014057e1cf2f7c194fb8b9400929219d274d34d9bb-ol10_aarch64_appstream
ipa-selinux-luna-4.13.4-1.0.1.el10_2.noarch.rpmf40587aa76c8e8940d26181604074dd9740a3807cdb53520fff77fc3d4ec4265-ol10_aarch64_appstream
ipa-selinux-nfast-4.13.4-1.0.1.el10_2.noarch.rpm093a855935f0880a1eedfd336f0d9ca632c9fc87786a77345734fedf9acffa5d-ol10_aarch64_appstream
ipa-server-4.13.4-1.0.1.el10_2.aarch64.rpmd1df57cd6d7b9e296c26c037d5b375a2f6b284ed07b5cc334c323425311678d5-ol10_aarch64_appstream
ipa-server-common-4.13.4-1.0.1.el10_2.noarch.rpm3e9439213362603454289dd38481adc32682b4417ed3325ad3420ad94bc36357-ol10_aarch64_appstream
ipa-server-dns-4.13.4-1.0.1.el10_2.noarch.rpmba52fc78778cd23c7b69f319bb9a952c435ce847b17780f2982be07d76cc5eb8-ol10_aarch64_appstream
ipa-server-encrypted-dns-4.13.4-1.0.1.el10_2.aarch64.rpm4e72bd5ea13608d1ffc28de1ea1da730ce767c2f69c00928dadbf31dd1d5b32e-ol10_aarch64_appstream
ipa-server-trust-ad-4.13.4-1.0.1.el10_2.aarch64.rpmd4cc3a7cfd84e8e94d4863da6775c4b6b1439d5b851b3201224187385a23eb30-ol10_aarch64_appstream
python3-ipaclient-4.13.4-1.0.1.el10_2.noarch.rpme3485da04b31146d1e4fce83fd0bb13e475b1078f909daa5fc76d22d64c31ea4-ol10_aarch64_appstream
python3-ipalib-4.13.4-1.0.1.el10_2.noarch.rpm8b91a451c9aa4c3a5fa06a835b07e6ec6f9ee335ed05f54c0fd2c52733e7e75f-ol10_aarch64_appstream
python3-ipaserver-4.13.4-1.0.1.el10_2.noarch.rpm630fd89f55c7abacd2ad7662dc750119dfff1719e37c5c490dacbf5a5e4f7012-ol10_aarch64_appstream
python3-ipatests-4.13.4-1.0.1.el10_2.noarch.rpm674018b4a9680f8c5f31b9814f6eaba9de2a9c780bba6c7d9ac707ecfb1ff3f3-ol10_aarch64_codeready_builder
Oracle Linux 10 (x86_64) ipa-4.13.4-1.0.1.el10_2.src.rpm1d05c67ba6d2480decab9244851a4fe3defbace6b93c706281f1f85883925caf-ol10_x86_64_appstream
ipa-4.13.4-1.0.1.el10_2.src.rpm1d05c67ba6d2480decab9244851a4fe3defbace6b93c706281f1f85883925caf-ol10_x86_64_codeready_builder
ipa-client-4.13.4-1.0.1.el10_2.x86_64.rpm1d4b8237832891db157b77d2ea45d8576ad6c1536188091eac7feb4d7e8700cb-ol10_x86_64_appstream
ipa-client-common-4.13.4-1.0.1.el10_2.noarch.rpme95a77a48f377766c8c81c3e219d20819055834a4a9740743549b6d60784e4f7-ol10_x86_64_appstream
ipa-client-encrypted-dns-4.13.4-1.0.1.el10_2.x86_64.rpm3e89d5224f8a5df8d450d29dee22e69e368d03cf13ba8b839a488b6042d6e719-ol10_x86_64_appstream
ipa-client-epn-4.13.4-1.0.1.el10_2.x86_64.rpm5c5eb3c059244a85faad9f432c8e23696bccd6aac94bfa02dddd62b3b7569210-ol10_x86_64_appstream
ipa-client-samba-4.13.4-1.0.1.el10_2.x86_64.rpm3518ec7fd4180c6e628ae0c2d44c79a9433cbef8597c4b72fa0768e0105b20ab-ol10_x86_64_appstream
ipa-common-4.13.4-1.0.1.el10_2.noarch.rpmc674e8f50e6b523bc846b1e569fca5193a875552aba79a981a3b42b2a24ebacf-ol10_x86_64_appstream
ipa-selinux-4.13.4-1.0.1.el10_2.noarch.rpm5edd9e9bc2e506e5cb8de4014057e1cf2f7c194fb8b9400929219d274d34d9bb-ol10_x86_64_appstream
ipa-selinux-luna-4.13.4-1.0.1.el10_2.noarch.rpmf40587aa76c8e8940d26181604074dd9740a3807cdb53520fff77fc3d4ec4265-ol10_x86_64_appstream
ipa-selinux-nfast-4.13.4-1.0.1.el10_2.noarch.rpm093a855935f0880a1eedfd336f0d9ca632c9fc87786a77345734fedf9acffa5d-ol10_x86_64_appstream
ipa-server-4.13.4-1.0.1.el10_2.x86_64.rpm79226e5bb41cc488dda3cc7397f763a2c31ad89929e855fff6e5d3b47051b145-ol10_x86_64_appstream
ipa-server-common-4.13.4-1.0.1.el10_2.noarch.rpm3e9439213362603454289dd38481adc32682b4417ed3325ad3420ad94bc36357-ol10_x86_64_appstream
ipa-server-dns-4.13.4-1.0.1.el10_2.noarch.rpmba52fc78778cd23c7b69f319bb9a952c435ce847b17780f2982be07d76cc5eb8-ol10_x86_64_appstream
ipa-server-encrypted-dns-4.13.4-1.0.1.el10_2.x86_64.rpm875ee903a91a636ad43b75d0e03e3dc4770222217dad91b9efcfb8cb25078a11-ol10_x86_64_appstream
ipa-server-trust-ad-4.13.4-1.0.1.el10_2.x86_64.rpmf56237b09dd1007f8dc06c43ec09ade50e69a19b590d45a44763befc8a31b23d-ol10_x86_64_appstream
python3-ipaclient-4.13.4-1.0.1.el10_2.noarch.rpme3485da04b31146d1e4fce83fd0bb13e475b1078f909daa5fc76d22d64c31ea4-ol10_x86_64_appstream
python3-ipalib-4.13.4-1.0.1.el10_2.noarch.rpm8b91a451c9aa4c3a5fa06a835b07e6ec6f9ee335ed05f54c0fd2c52733e7e75f-ol10_x86_64_appstream
python3-ipaserver-4.13.4-1.0.1.el10_2.noarch.rpm630fd89f55c7abacd2ad7662dc750119dfff1719e37c5c490dacbf5a5e4f7012-ol10_x86_64_appstream
python3-ipatests-4.13.4-1.0.1.el10_2.noarch.rpm674018b4a9680f8c5f31b9814f6eaba9de2a9c780bba6c7d9ac707ecfb1ff3f3-ol10_x86_64_codeready_builder



This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team

software.hardware.complete