[CLSA-2026:1791364402] ipa: Fix of 8 CVEs
Type:
security
Severity:
Critical
Release date:
2026-10-07 11:56:00 UTC
Description:
- CVE-2026-76578: constrain the self-managed OTP token ACI, deny anonymous modifications and harden self-service and delegated-write ACIs - CVE-2026-79678: enforce managed permissions before LDAP-oriented commands run their callbacks, and require privileges for RA-agent backed operations - CVE-2026-13097: enforce Kerberos principal name uniqueness with a principal-aware matching rule (new ipa-krbprinc-mr 389-ds plugin) - CVE-2026-11861: validate the PAC of cross-realm trust tickets in the KDB driver, including ID override checks - CVE-2026-73198: limit the request body size of the unauthenticated /ipa/i18n_messages endpoint - CVE-2026-73197: reject oversized Content-Length in the unauthenticated password migration endpoint - CVE-2026-19550: require write access to the trust entry for trust-fetch-domains - CVE-2026-18147: remove the redirect from the Web UI password reset page
CVEs fixed:
Updated packages:
  • ipa-client-4.12.2-14.0.1.el9_6.5.tuxcare.els3.aarch64.rpm
    sha:0e94b7b680ca32a80eb96a60c5b26002b6fd506739250275483e52796a16ad38
  • ipa-client-4.12.2-14.0.1.el9_6.5.tuxcare.els3.i686.rpm
    sha:f08a7fbe6fe133a71d3e5fad680122d4a776868ddab7e3842b530df884688348
  • ipa-client-4.12.2-14.0.1.el9_6.5.tuxcare.els3.x86_64.rpm
    sha:8ce6d65c11c2ab130d207c846b4d9e0ebdd74d7e6c614728acd19691e4f43a77
  • ipa-client-common-4.12.2-14.0.1.el9_6.5.tuxcare.els3.noarch.rpm
    sha:c6377607d91d59943b1a9a9d83f54ad246eaa6af57c9faf378439fc3189161cf
  • ipa-client-encrypted-dns-4.12.2-14.0.1.el9_6.5.tuxcare.els3.aarch64.rpm
    sha:336404513767663cd49710493cf9910328006b4108f129dcff4a67c6f3327a77
  • ipa-client-encrypted-dns-4.12.2-14.0.1.el9_6.5.tuxcare.els3.i686.rpm
    sha:459aca1e51e7099fc95f9ac4b098933e02b3d7d246e9b10d09bd07aefa55002b
  • ipa-client-encrypted-dns-4.12.2-14.0.1.el9_6.5.tuxcare.els3.x86_64.rpm
    sha:904164cdd35c3c875c794958f5bc8312b22da955b3f7e948a3b26b2028afeff3
  • ipa-client-epn-4.12.2-14.0.1.el9_6.5.tuxcare.els3.aarch64.rpm
    sha:548390685f7086f8a628bf05832ef14e07a78f37eb1a69a2fa683a5b4ccb4c97
  • ipa-client-epn-4.12.2-14.0.1.el9_6.5.tuxcare.els3.i686.rpm
    sha:a8c261ef3571b8846432fbd91f8b6f9824b7537b24c639548ed0182867b28ecd
  • ipa-client-epn-4.12.2-14.0.1.el9_6.5.tuxcare.els3.x86_64.rpm
    sha:0cd0c9618246513ac0c70c48c52556bf7008f3f93ff18fc06fafe1ea61271a29
  • ipa-client-samba-4.12.2-14.0.1.el9_6.5.tuxcare.els3.aarch64.rpm
    sha:cf6b07ff542c2b1b79b2609cbf87d538a8f9db9d2fa7a6ee32597e2a3c33d25c
  • ipa-client-samba-4.12.2-14.0.1.el9_6.5.tuxcare.els3.i686.rpm
    sha:13184ea168a88d49ef53e66a84362c34fe229fcc0d32db64128becd91fa0b6dc
  • ipa-client-samba-4.12.2-14.0.1.el9_6.5.tuxcare.els3.x86_64.rpm
    sha:b782b78b01bc9a82ec5ec795ce8d142e007828289b8484629eb35e9bf778de05
  • ipa-common-4.12.2-14.0.1.el9_6.5.tuxcare.els3.noarch.rpm
    sha:8cdf2ebf3d0724fa127bc1b458b4476a23b4afbae6035586951b54baf0bc3c49
  • ipa-python-compat-4.12.2-14.0.1.el9_6.5.tuxcare.els3.noarch.rpm
    sha:992a7bfcd3d9641be706ef3012299a5bd9468b13b801b2c8ee68ab6abaa956c6
  • ipa-selinux-4.12.2-14.0.1.el9_6.5.tuxcare.els3.noarch.rpm
    sha:5af972a0077647fb96107f92be914ac2afcf3c856823c6ecbd5f5f202e1244d3
  • ipa-selinux-luna-4.12.2-14.0.1.el9_6.5.tuxcare.els3.noarch.rpm
    sha:aaef2c6efef1c0850f412cfa585f54675e1ab7a1760b0adbf3ee6e774371f960
  • ipa-selinux-nfast-4.12.2-14.0.1.el9_6.5.tuxcare.els3.noarch.rpm
    sha:24742005b8a14e78887f10d9125cbc1fe7c956d37cf2f3da68e3495f1f651730
  • ipa-server-4.12.2-14.0.1.el9_6.5.tuxcare.els3.aarch64.rpm
    sha:9e9febc40875374d58a7a3ea4ecb6facc6d30f1e14d1842b309da219fa2da5e3
  • ipa-server-4.12.2-14.0.1.el9_6.5.tuxcare.els3.x86_64.rpm
    sha:de74b9287d4762517dbe8d5055e7d64cff38bd6865e21b6768aa6bd321499e58
  • ipa-server-common-4.12.2-14.0.1.el9_6.5.tuxcare.els3.noarch.rpm
    sha:ddfcfd67c192854ca3e2cc99431330e195a11af9fd1e90d6b6869544a8fd09e0
  • ipa-server-dns-4.12.2-14.0.1.el9_6.5.tuxcare.els3.noarch.rpm
    sha:36403e4c5a05bdcf6ca2eedc4eb4c55b07068232edf3982ee11c71ba274713b2
  • ipa-server-encrypted-dns-4.12.2-14.0.1.el9_6.5.tuxcare.els3.aarch64.rpm
    sha:76881732c920f89458664e6d7b43ef2f5987f5763bd6e8a99bbfff058aad9cda
  • ipa-server-encrypted-dns-4.12.2-14.0.1.el9_6.5.tuxcare.els3.x86_64.rpm
    sha:620350454c65484b6d11237eede67fc55f25792b8d5200f555edea448373f0fc
  • ipa-server-trust-ad-4.12.2-14.0.1.el9_6.5.tuxcare.els3.aarch64.rpm
    sha:903c9f1adf3cd1f080e76343ed096f0f932e9374ee263b80d0116829e7a91844
  • ipa-server-trust-ad-4.12.2-14.0.1.el9_6.5.tuxcare.els3.x86_64.rpm
    sha:c18e3434e94cb0f8005c154b04c702032e2c720134d44a7af9c91cd6ee582c60
  • python3-ipaclient-4.12.2-14.0.1.el9_6.5.tuxcare.els3.noarch.rpm
    sha:07d8ec78c0f7b8cad6d13ab762420ed381c0e2dce00150563aed3eccb49bfc0a
  • python3-ipalib-4.12.2-14.0.1.el9_6.5.tuxcare.els3.noarch.rpm
    sha:97e6010b1bff8922f31ca55ae0882e2d643093af7b0f4afd2f651e17cb0f3964
  • python3-ipaserver-4.12.2-14.0.1.el9_6.5.tuxcare.els3.noarch.rpm
    sha:5a9e4db5d34b81c69adb1360617d910351ed8524441482eb801cd9e76deaa743
  • python3-ipatests-4.12.2-14.0.1.el9_6.5.tuxcare.els3.noarch.rpm
    sha:2eb2a81e8a59ad270f21b6756489a3c88529f39eca0c91c2ae2a0ba5d32dcd54
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.