ELSA-2026-72279

ELSA-2026-72279 - ipa security, bug fix, and enhancement update

Type:	SECURITY
Impact:	CRITICAL
Release Date:	2026-09-28

Description

[4.13.4-1.0.1]
- Set IPAPLATFORM=rhel when build on Oracle Linux [Orabug: 29516674]
- Add bind to ipa-server-common Requires [Orabug: 36518596]

[4.13.4-1]
- Resolves: RHEL-248199 CVE-2026-79678 ipa: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service
- Resolves: RHEL-245626 CVE-2026-19550 ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes [rhel-10.2.z]
- Resolves: RHEL-245473 CVE-2026-76578 ipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI
- Resolves: RHEL-240909 CVE-2026-13097 ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore [rhel-10.2.z]
- Resolves: RHEL-240842 CVE-2026-11861 ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships [rhel-10.2.z]
- Resolves: RHEL-240821 CVE-2026-73197 ipa: FreeIPA: Unauthenticated DoS in /ipa/migration/migration.py via Unbounded Request Body Read [rhel-10.2.z]
- Resolves: RHEL-240800 CVE-2026-73198 ipa: FreeIPA: Unauthenticated DoS in /ipa/i18n_messages via Unbounded Request Body Read [rhel-10.2.z]
- Resolves: RHEL-240768 ipa-migrate tool is renaming host records & host info in automount information [rhel-10.2.z]
- Resolves: RHEL-238676 ipa-migrate: require Replication Administrator privilege [rhel-10.2.z]
- Resolves: RHEL-238673 ipa-epn: drop_privileges method is mixing uid and gid [rhel-10.2.z]
- Resolves: RHEL-238526 ipa env: support only simple * wildcard [rhel-10.2.z]
- Resolves: RHEL-238522 host-mod: handle the password attribute when set with --setattr userpassword= [rhel-10.2.z]
- Resolves: RHEL-238518 ipa-otptoken-import hardening [rhel-10.2.z]
- Resolves: RHEL-238516 Remove NetBIOS dependencies in Identity Manager [rhel-10.2.z]
- Resolves: RHEL-238510 WebUI Hardening [rhel-10.2.z]
- Resolves: RHEL-218853 CVE-2026-18147 ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL
- Resolves: RHEL-173375 [Cursor Automated] Include latest fixes in python3-ipatests package [RHEL10.2]

[4.13.1-3.2]
- Resolves: RHEL-168516 TestIPAMigrationProdMode tests are missing

[4.13.1-3.1]
- Resolves: RHEL-155027 Adding a group with 32Bit Idrange fails
- Resolves: RHEL-153145 IdM password policy Min lifetime is not enforced when high minlife is set
- Resolves: RHEL-166864 Include latest fixes in python3-ipatests package

Related CVEs

CVE-2026-11861

CVE-2026-13097

CVE-2026-18147

CVE-2026-19550

CVE-2026-73197

CVE-2026-73198

CVE-2026-76578

CVE-2026-79678

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 10 (aarch64)	ipa-4.13.4-1.0.1.el10_2.src.rpm	1d05c67ba6d2480decab9244851a4fe3defbace6b93c706281f1f85883925caf	-	ol10_aarch64_appstream
	ipa-4.13.4-1.0.1.el10_2.src.rpm	1d05c67ba6d2480decab9244851a4fe3defbace6b93c706281f1f85883925caf	-	ol10_aarch64_codeready_builder
	ipa-client-4.13.4-1.0.1.el10_2.aarch64.rpm	6e08ca1d6e21c9d4e6f34c2bd6080c1c36687e0d4069339b3c19d0f7c65b4e40	-	ol10_aarch64_appstream
	ipa-client-common-4.13.4-1.0.1.el10_2.noarch.rpm	e95a77a48f377766c8c81c3e219d20819055834a4a9740743549b6d60784e4f7	-	ol10_aarch64_appstream
	ipa-client-encrypted-dns-4.13.4-1.0.1.el10_2.aarch64.rpm	19a62fb123620a1fb156c5259437e51f8df326aaeeae51863070cb3e0e0345d4	-	ol10_aarch64_appstream
	ipa-client-epn-4.13.4-1.0.1.el10_2.aarch64.rpm	1fb6be9f3b3d8fc0a810347e1a1bb57f0ee1a870638f940adfbfb96a8cd35b0e	-	ol10_aarch64_appstream
	ipa-client-samba-4.13.4-1.0.1.el10_2.aarch64.rpm	ed2568c14661c5486adf9930f320f5c1c80a8bba1db1d683748bb928b39fccfe	-	ol10_aarch64_appstream
	ipa-common-4.13.4-1.0.1.el10_2.noarch.rpm	c674e8f50e6b523bc846b1e569fca5193a875552aba79a981a3b42b2a24ebacf	-	ol10_aarch64_appstream
	ipa-selinux-4.13.4-1.0.1.el10_2.noarch.rpm	5edd9e9bc2e506e5cb8de4014057e1cf2f7c194fb8b9400929219d274d34d9bb	-	ol10_aarch64_appstream
	ipa-selinux-luna-4.13.4-1.0.1.el10_2.noarch.rpm	f40587aa76c8e8940d26181604074dd9740a3807cdb53520fff77fc3d4ec4265	-	ol10_aarch64_appstream
	ipa-selinux-nfast-4.13.4-1.0.1.el10_2.noarch.rpm	093a855935f0880a1eedfd336f0d9ca632c9fc87786a77345734fedf9acffa5d	-	ol10_aarch64_appstream
	ipa-server-4.13.4-1.0.1.el10_2.aarch64.rpm	d1df57cd6d7b9e296c26c037d5b375a2f6b284ed07b5cc334c323425311678d5	-	ol10_aarch64_appstream
	ipa-server-common-4.13.4-1.0.1.el10_2.noarch.rpm	3e9439213362603454289dd38481adc32682b4417ed3325ad3420ad94bc36357	-	ol10_aarch64_appstream
	ipa-server-dns-4.13.4-1.0.1.el10_2.noarch.rpm	ba52fc78778cd23c7b69f319bb9a952c435ce847b17780f2982be07d76cc5eb8	-	ol10_aarch64_appstream
	ipa-server-encrypted-dns-4.13.4-1.0.1.el10_2.aarch64.rpm	4e72bd5ea13608d1ffc28de1ea1da730ce767c2f69c00928dadbf31dd1d5b32e	-	ol10_aarch64_appstream
	ipa-server-trust-ad-4.13.4-1.0.1.el10_2.aarch64.rpm	d4cc3a7cfd84e8e94d4863da6775c4b6b1439d5b851b3201224187385a23eb30	-	ol10_aarch64_appstream
	python3-ipaclient-4.13.4-1.0.1.el10_2.noarch.rpm	e3485da04b31146d1e4fce83fd0bb13e475b1078f909daa5fc76d22d64c31ea4	-	ol10_aarch64_appstream
	python3-ipalib-4.13.4-1.0.1.el10_2.noarch.rpm	8b91a451c9aa4c3a5fa06a835b07e6ec6f9ee335ed05f54c0fd2c52733e7e75f	-	ol10_aarch64_appstream
	python3-ipaserver-4.13.4-1.0.1.el10_2.noarch.rpm	630fd89f55c7abacd2ad7662dc750119dfff1719e37c5c490dacbf5a5e4f7012	-	ol10_aarch64_appstream
	python3-ipatests-4.13.4-1.0.1.el10_2.noarch.rpm	674018b4a9680f8c5f31b9814f6eaba9de2a9c780bba6c7d9ac707ecfb1ff3f3	-	ol10_aarch64_codeready_builder
Oracle Linux 10 (x86_64)	ipa-4.13.4-1.0.1.el10_2.src.rpm	1d05c67ba6d2480decab9244851a4fe3defbace6b93c706281f1f85883925caf	-	ol10_x86_64_appstream
	ipa-4.13.4-1.0.1.el10_2.src.rpm	1d05c67ba6d2480decab9244851a4fe3defbace6b93c706281f1f85883925caf	-	ol10_x86_64_codeready_builder
	ipa-client-4.13.4-1.0.1.el10_2.x86_64.rpm	1d4b8237832891db157b77d2ea45d8576ad6c1536188091eac7feb4d7e8700cb	-	ol10_x86_64_appstream
	ipa-client-common-4.13.4-1.0.1.el10_2.noarch.rpm	e95a77a48f377766c8c81c3e219d20819055834a4a9740743549b6d60784e4f7	-	ol10_x86_64_appstream
	ipa-client-encrypted-dns-4.13.4-1.0.1.el10_2.x86_64.rpm	3e89d5224f8a5df8d450d29dee22e69e368d03cf13ba8b839a488b6042d6e719	-	ol10_x86_64_appstream
	ipa-client-epn-4.13.4-1.0.1.el10_2.x86_64.rpm	5c5eb3c059244a85faad9f432c8e23696bccd6aac94bfa02dddd62b3b7569210	-	ol10_x86_64_appstream
	ipa-client-samba-4.13.4-1.0.1.el10_2.x86_64.rpm	3518ec7fd4180c6e628ae0c2d44c79a9433cbef8597c4b72fa0768e0105b20ab	-	ol10_x86_64_appstream
	ipa-common-4.13.4-1.0.1.el10_2.noarch.rpm	c674e8f50e6b523bc846b1e569fca5193a875552aba79a981a3b42b2a24ebacf	-	ol10_x86_64_appstream
	ipa-selinux-4.13.4-1.0.1.el10_2.noarch.rpm	5edd9e9bc2e506e5cb8de4014057e1cf2f7c194fb8b9400929219d274d34d9bb	-	ol10_x86_64_appstream
	ipa-selinux-luna-4.13.4-1.0.1.el10_2.noarch.rpm	f40587aa76c8e8940d26181604074dd9740a3807cdb53520fff77fc3d4ec4265	-	ol10_x86_64_appstream
	ipa-selinux-nfast-4.13.4-1.0.1.el10_2.noarch.rpm	093a855935f0880a1eedfd336f0d9ca632c9fc87786a77345734fedf9acffa5d	-	ol10_x86_64_appstream
	ipa-server-4.13.4-1.0.1.el10_2.x86_64.rpm	79226e5bb41cc488dda3cc7397f763a2c31ad89929e855fff6e5d3b47051b145	-	ol10_x86_64_appstream
	ipa-server-common-4.13.4-1.0.1.el10_2.noarch.rpm	3e9439213362603454289dd38481adc32682b4417ed3325ad3420ad94bc36357	-	ol10_x86_64_appstream
	ipa-server-dns-4.13.4-1.0.1.el10_2.noarch.rpm	ba52fc78778cd23c7b69f319bb9a952c435ce847b17780f2982be07d76cc5eb8	-	ol10_x86_64_appstream
	ipa-server-encrypted-dns-4.13.4-1.0.1.el10_2.x86_64.rpm	875ee903a91a636ad43b75d0e03e3dc4770222217dad91b9efcfb8cb25078a11	-	ol10_x86_64_appstream
	ipa-server-trust-ad-4.13.4-1.0.1.el10_2.x86_64.rpm	f56237b09dd1007f8dc06c43ec09ade50e69a19b590d45a44763befc8a31b23d	-	ol10_x86_64_appstream
	python3-ipaclient-4.13.4-1.0.1.el10_2.noarch.rpm	e3485da04b31146d1e4fce83fd0bb13e475b1078f909daa5fc76d22d64c31ea4	-	ol10_x86_64_appstream
	python3-ipalib-4.13.4-1.0.1.el10_2.noarch.rpm	8b91a451c9aa4c3a5fa06a835b07e6ec6f9ee335ed05f54c0fd2c52733e7e75f	-	ol10_x86_64_appstream
	python3-ipaserver-4.13.4-1.0.1.el10_2.noarch.rpm	630fd89f55c7abacd2ad7662dc750119dfff1719e37c5c490dacbf5a5e4f7012	-	ol10_x86_64_appstream
	python3-ipatests-4.13.4-1.0.1.el10_2.noarch.rpm	674018b4a9680f8c5f31b9814f6eaba9de2a9c780bba6c7d9ac707ecfb1ff3f3	-	ol10_x86_64_codeready_builder

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team