{"cves":["CVE-2019-11358","CVE-2015-9251","CVE-2020-11022","CVE-2018-20677","CVE-2018-14042","CVE-2018-20676","CVE-2018-14040","CVE-2019-8331","CVE-2020-1722","CVE-2016-10735"],"cvss":0.0,"database_specific":{"severity":"MODERATE"},"description":"[4.6.8-5.0.1]\n- Blank out header-logo.png product-name.png\n- Replace login-screen-logo.png [Orabug: 20362818]\n\n[4.6.8-5.el7]\n- Resolves: #1826659 IPA: Ldap authentication failure due to Kerberos principal expiration UTC timestamp\n  -  ipa-pwd-extop: use timegm() instead of mktime() to preserve timezone offset\n\n[4.6.8-4.el7]\n- Resolves: #1842950 ipa-adtrust-install fails when replica is offline\n  - ipa-adtrust-install: avoid failure when replica is offline\n- Resolves: #1831856 CVE-2020-11022 ipa: jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method\n  - WebUI: Apply jQuery patch to fix htmlPrefilter issue\n\n[4.6.8-3.el7]\n- Resolves: #1834385 Man page syntax issue detected by rpminspect\n  - Man pages: fix syntax issues\n- Resolves: #1829787 ipa service-del deletes the required principal when specified in lower/upper case\n  - Make check_required_principal() case-insensitive\n- Resolves: #1825829 ipa-advise on a RHEL7 IdM server generate a configuration script for client having hardcoded python3\n  - ipa-advise: fallback to /usr/libexec/platform-python if python3 not found\n- Resolves: #1812020 CVE-2015-9251 ipa: js-jquery: Cross-site scripting via cross-domain ajax requests\n  - Web UI: Upgrade jQuery version 2.0.3 - 3.4.1\n- Resolves: #1713487 CVE-2019-11358 ipa: js-jquery: prototype pollution in objects prototype leading to denial of service or remote code execution or property injection\n  - Web UI: Upgrade jQuery version 2.0.3 - 3.4.1\n\n[4.6.8-2.el7]\n- Resolves: #1802408 CVE-2020-1722 ipa: No password length restriction leads to denial of service\n  - Add interactive prompt for the LDAP bind password to ipa-getkeytab\n  - CVE-2020-1722: prevent use of too long passwords\n\n[4.6.8-1.el7]\n- Resolves: #1819725 - Rebase IPA to latest 4.6.x version\n- Resolves: #1817927 - host-add --password logs cleartext userpassword to Apache error log\n- Resolves: #1817923 - IPA upgrade is failing with error 'Failed to get request: bus, object_path and dbus_interface must not be None.'\n- Resolves: #1817922 - covscan memory leaks report\n- Resolves: #1817919 - Enable compat tree to provide information about AD users and groups on trust agents\n- Resolves: #1817918 - Secure tomcat AJP connector\n- Resolves: #1817886 - ipa group-add-member: prevent adding IPA objects as external members\n- Resolves: #1788718 - ipa-server-install incorrectly setting slew mode (-x) when setting up ntpd\n\n[4.6.6-12.el7]\n- Resolves: #1754902 - Running ipa-server-install fails when RHEL 7.7 packages are installed on RHEL 7.6\n- Resolves: #1404770 - ID Views: do not allow custom Views for the masters\n  - idviews: prevent applying to a master\n- Resolves: #1801791 - Compatibility Schema difference in functionality for systems following RHEL 7.5 - 7.6 upgrade path as opposed to new RHEL 7.6 systems\n  - install/updates: move external members past schema compat update\n- Resolves: #1795890 - ipa-pkinit-manage enable fails on replica if it doesnt host the CA\n  - pkinit setup: fix regression on master install\n  - pkinit enable: use local dogtag only if host has CA\n- Resolves: #1788907 - Renewed certs are not picked up by IPA CAs\n  - Allow an empty cookie in dogtag-ipa-ca-renew-agent-submit\n- Resolves: #1780548 - Man page ipa-cacert-manage does not display correctly on RHEL\n  - ipa-cacert-manage man page: fix indentation\n- Resolves: #1782587 - add 'systemctl restart sssd' to warning message when adding trust agents to replicas\n  - adtrust.py: mention restarting sssd when adding trust agents\n- Resolves: #1771356 - Default client configuration breaks ssh in FIPS mode\n  - Use default ssh host key algorithms\n- Resolves: #1755535 - ipa-advise on a RHEL7 IdM server is not able to generate a configuration script for a RHEL8 IdM client\n  - smartcard: make the ipa-advise script compatible with authselect/authconfig\n- Resolves: #1758406 - KRA authentication fails when IPA CA has custom Subject DN\n  - upgrade: fix ipakra people entry 'description' attribute\n  - krainstance: set correct issuer DN in uid=ipakra entry\n- Resolves: #1756568 - ipa-server-certinstall man page does not match built-in help\n  - ipa-server-certinstall manpage: add missing options\n- Resolves: #1206690 - UPG not being enforced properly\n  - ipa user_add: do not check group if UPG is disabled\n- Resolves: #1811982 - CVE-2018-14042 ipa: bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip.\n- Resolves: #1811978 - CVE-2018-14040 ipa: bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute\n- Resolves: #1811972 - CVE-2016-10735 ipa: bootstrap: XSS in the data-target attribute\n- Resolves: #1811969 -CVE-2018-20676 ipa: bootstrap: XSS in the tooltip data-viewport attribute\n- Resolves: #1811966 - CVE-2018-20677 ipa: bootstrap: XSS in the affix configuration target property\n- Resolves: #1811962 - CVE-2019-8331 ipa: bootstrap: XSS in the tooltip or popover data-template attribute\n  - Web UI: Upgrade Bootstrap version 3.3.7 - 3.4.1\n- Resolves: #1769791 - Invisible part of notification area in Web UI intercepts clicks of some page elements\n  - WebUI: Fix notification area layout\n- Resolves: #1545755 - ipa-replica-prepare should not update pki admin password\n  - Fix indentation levels\n  - ipa-pwd-extop: use SLAPI_BIND_TARGET_SDN\n  - ipa-pwd-extop: dont check password policy for non-Kerberos account set by DM or a passsync manager\n  - Dont save password history on non-Kerberos accounts","id":"ELSA-2020-3936","ovalId":"oval:com.oracle.elsa:def:20203936","source":"oracle_linux","title":"ELSA-2020-3936:  ipa security, bug fix, and enhancement update (MODERATE)","url":"https://linux.oracle.com/errata/ELSA-2020-3936.html"}