[CLSA-2026:1791544796] ipa: Fix of 4 CVEs
Type:
security
Severity:
Important
Release date:
2026-10-09 14:02:25 UTC
Description:
- CVE-2026-11861: validate the PAC of cross-realm trust tickets in the KDB driver, including ID override checks - CVE-2026-13097: enforce Kerberos principal name uniqueness with a principal-aware matching rule (new ipa-krbprinc-mr 389-ds plugin) - CVE-2026-18147: remove the arbitrary URL redirect from the Web UI password reset page - CVE-2026-19550: require write access to the trust entry before refreshing trust domains - do not fail ipa-server or ipa-server-trust-ad removal on hosts without a running systemd, such as container images: the dbus and oddjobd reload calls in the install and removal scriptlets now tolerate failure, like the stop, disable and condrestart calls beside them
CVEs fixed:
Updated packages:
  • ipa-client-4.10.1-9.el9_2.alma.1.tuxcare.els4.aarch64.rpm
    sha:2abd3d6a57bd8e36b77ee7f5e7bb7749e889a99d5aabd3e6e5e939501df6a87c
  • ipa-client-4.10.1-9.el9_2.alma.1.tuxcare.els4.i686.rpm
    sha:25599ef6f9a6c802b05c104deabc23999d1f23f74cdb9b94f523ffd0ba8e9595
  • ipa-client-4.10.1-9.el9_2.alma.1.tuxcare.els4.x86_64.rpm
    sha:21a4fc811d6122bc2c0c4f6452d06db227fb8951f29b8dfeeb01f876c9c23677
  • ipa-client-common-4.10.1-9.el9_2.alma.1.tuxcare.els4.noarch.rpm
    sha:f0622d8ce1738c8e73929c0ba27c0bf898e59bcb97e5454a361c512d1823cac5
  • ipa-client-epn-4.10.1-9.el9_2.alma.1.tuxcare.els4.aarch64.rpm
    sha:b9279fe525d75770999fad19ca5c70d97f8b46836bd6b7c267efad9d590bdb8f
  • ipa-client-epn-4.10.1-9.el9_2.alma.1.tuxcare.els4.i686.rpm
    sha:b19f3dbe8996108797daeab167d71748f3266c7bda2557b23ce046a4e1ed2818
  • ipa-client-epn-4.10.1-9.el9_2.alma.1.tuxcare.els4.x86_64.rpm
    sha:a09af14b89d32ce8525a7fa3ccfedebc8738350c1aa23c4dd140c732692f072f
  • ipa-client-samba-4.10.1-9.el9_2.alma.1.tuxcare.els4.aarch64.rpm
    sha:956af1ba0aa0a3685fd4ceff27c2d06704d973f7c1a05e58156c9b3c14249fab
  • ipa-client-samba-4.10.1-9.el9_2.alma.1.tuxcare.els4.i686.rpm
    sha:def1857ee24d8627725890dd4cb94a3c7f48470ae1f57c319f34a8a48368d7bd
  • ipa-client-samba-4.10.1-9.el9_2.alma.1.tuxcare.els4.x86_64.rpm
    sha:62f5cad013ea87d86e8b98068580782285291d413ff94d76747b871f098df95f
  • ipa-common-4.10.1-9.el9_2.alma.1.tuxcare.els4.noarch.rpm
    sha:10b877b21efee30015c9cd8ffe3abc01c1345ab4a79c52e9e863d0fd9308ff42
  • ipa-python-compat-4.10.1-9.el9_2.alma.1.tuxcare.els4.noarch.rpm
    sha:d8396dc21769c30f794f0a48141b007d1846f2e1710b0182b6b5d90b9744ec15
  • ipa-selinux-4.10.1-9.el9_2.alma.1.tuxcare.els4.noarch.rpm
    sha:2e384721bcd1207ac359b6d9c621bf3f18c9f98c87b9cb4272b606ca6ef9deda
  • ipa-server-4.10.1-9.el9_2.alma.1.tuxcare.els4.aarch64.rpm
    sha:e86b0717cf3d70a9d3453d7f8b22bc5f97ccbc3d6e3476b48615b7ab50243f84
  • ipa-server-4.10.1-9.el9_2.alma.1.tuxcare.els4.x86_64.rpm
    sha:a7718c51ff8ac0ba1e1fc911e0b3b1fc300808058661f26f2e5da84cb858fca8
  • ipa-server-common-4.10.1-9.el9_2.alma.1.tuxcare.els4.noarch.rpm
    sha:2c7d82aca2626f26a655e09c45e63e09d96299fed3d39b740e16962abfd956ef
  • ipa-server-dns-4.10.1-9.el9_2.alma.1.tuxcare.els4.noarch.rpm
    sha:03b89ac17b6300b921de256f27cd8e218f6301e4a45863b2a09501d14fdc2808
  • ipa-server-trust-ad-4.10.1-9.el9_2.alma.1.tuxcare.els4.aarch64.rpm
    sha:a10fd483418c0f21adfa92e347bbb1d1e3dea3393b0c680f506c1e4887fa7fae
  • ipa-server-trust-ad-4.10.1-9.el9_2.alma.1.tuxcare.els4.x86_64.rpm
    sha:e68db1ff5ce486e221469226506ca4a6401beee69e524ed4fc2bf837080a0c5e
  • python3-ipaclient-4.10.1-9.el9_2.alma.1.tuxcare.els4.noarch.rpm
    sha:bdf22ecf805b020925f86cf31ad8976cbb2f5b2592c1ca0c98596d939267c3aa
  • python3-ipalib-4.10.1-9.el9_2.alma.1.tuxcare.els4.noarch.rpm
    sha:56cca651b5d91bcae85cbd097f21f546ad6ab5c5bb1edd47bfda548ed2c5307d
  • python3-ipaserver-4.10.1-9.el9_2.alma.1.tuxcare.els4.noarch.rpm
    sha:8ad58d0504f9d69a9dc3ac48ffd8e223c162ffdc8ec139f1d1933c05cf0f7459
  • python3-ipatests-4.10.1-9.el9_2.alma.1.tuxcare.els4.noarch.rpm
    sha:e5028b251f331af7f6f4df861d6e4809076f44f9b47d37efca16ecd5622610ef
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.