{
  "cves": [
    "CVE-2018-14040",
    "CVE-2018-20677",
    "CVE-2016-10735",
    "CVE-2018-14042",
    "CVE-2020-11022",
    "CVE-2019-8331",
    "CVE-2019-11358",
    "CVE-2020-1722",
    "CVE-2015-9251",
    "CVE-2018-20676"
  ],
  "cvss": 0.0,
  "database_specific": {
    "severity": "MODERATE"
  },
  "description": "bind-dyndb-ldap\n[11.3-1]\n- New upstream release\n- Resolves: rhbz#1845211\n\nipa\n[4.8.7-12.0.1]\n- Set IPAPLATFORM=rhel when build on Oracle Linux [Orabug: 29516674]\n\n[4.8.7-12]\n- Require selinux sub package in the proper version\n  Related: RHBZ#1868432\n- SELinux: do not double-define node_t and pki_tomcat_cert_t\n  Related: RHBZ#1868432\n- SELinux: add dedicated policy for ipa-pki-retrieve-key + ipatests\n  Related: RHBZ#1868432\n- dogtaginstance.py: add --debug to pkispawn\n  Resolves: RHBZ#1879604\n\n[4.8.7-11]\n- SELinux Policy: let custodia replicate keys\n  Resolves: RHBZ#1868432\n\n[4.8.7-10]\n- Set mode of /etc/ipa/ca.crt to 0644 in CA-less installations\n  Resolves: RHBZ#1870202\n\n[4.8.7-9]\n- CAless installation: set the perms on KDC cert file\n  Resolves: RHBZ#1863616\n- EPN: handle empty attributes\n  Resolves: RHBZ#1866938\n- IPA-EPN: enhance input validation\n  Resolves: RHBZ#1866291\n- EPN: enhance input validation\n  Resolves: RHBZ#1863079\n- Require new samba build 4.12.3-52\n  Related: RHBZ#1868558\n- Require new selinux-policy build 3.14.3-52\n  Related: RHBZ#1869311\n\n[4.8.7-8]\n- [WebUI] IPA Error 3007: RequirmentError while adding members in\n  User ID overrides tab (updated)\n  Resolves: RHBZ#1757045\n- ipa-client-install: use the authselect backup during uninstall\n  Resolves: RHBZ#1810179\n- Replace SSLCertVerificationError with CertificateError for py36\n  Resolves: RHBZ#1858318\n- Fix AVC denial during ipa-adtrust-install --add-agents\n  Resolves: RHBZ#1859213\n\n[4.8.7-7]\n- replica install failing with avc denial for custodia component\n  Resolves: RHBZ#1857157\n\n[4.8.7-6]\n- selinux dont audit rules deny fetching trust topology\n  Resolves: RHBZ#1845596\n- fix iPAddress cert issuance for 1 host/service\n  Resolves: RHBZ#1846352\n- Specify cert_paths when calling PKIConnection\n  Resolves: RHBZ#1849155\n- Update crypto policy to allow AD-SUPPORT when installing IPA\n  Resolves: RHBZ#1851139\n- Add version to ipa-idoverride-memberof obsoletes\n  Related: RHBZ#1846434\n\n[4.8.7-5]\n- Add missing ipa-selinux package\n  Resolves: RHBZ#1853263\n\n[4.8.7-4]\n- Remove client-epn left over files for ONLY_CLIENT\n  Related: RHBZ#1847999\n\n[4.8.7-3]\n- [WebUI] IPA Error 3007: RequirmentError while adding members in\n  User ID overrides tab\n  Resolves: RHBZ#1757045\n- EPN does not ship its default configuration ( /etc/ipa/epn.conf ) in\n  freeipa-client-epn\n  Resolves: RHBZ#1847999\n- FreeIPA - Utilize 256-bit AJP connector passwords\n  Resolves: RHBZ#1849914\n- ipa: typo issue in ipanthomedirectoryrive deffinition\n  Resolves: RHBZ#1851411\n\n[4.8.7-2]\n- Remove ipa-idoverride-memberof as superceded by ipa-server 4.8.7\n  Resolves: RHBZ#1846434\n\n[4.8.7-1]\n- Upstream release FreeIPA 4.8.7\n- Require new samba build 4.12.3-0\n  Related: RHBZ#1818765\n- New client-epn sub package\n  Resolves: RHBZ#913799\n\nipa-healthcheck\n[0.4-6]\n- The core subpackage can be installed standalone, drop the Requires\n  on the base package. (#1852244)\n- Add Conflicts  0.4 to to core to allow downgrading with\n  --allowerasing (#1852244)\n\n[0.4-5]\n- Remove the Obsoletes  0.4 and add same-version Requires to each\n  subpackage so that upgrades from 0.3 will work (#1852244)\n\nopendnssec\n[2.1.6-2]\n- Resolves: rhbz#1831732 AVC avc: denied { dac_override } for comm=ods-enforcerd\n\n[2.1.6-1]\n- Resolves: rhbz#1759888 Rebase OpenDNSSEC to 2.1\n\nslapi-nis\n[0.56.5-4]\n- Ignore unmatched searches\n- Resolves: rhbz#1874015\n\n[0.56.5-3]\n- Fix memory leaks in ID views processing\n- Resolves: rhbz#1875348\n\n[0.56.5-2]\n- Initialize map lock in NIS plugin\n- Resolves: rhbz#1832331\n\n[0.56.5-1]\n- Upstream release 0.56.5\n- Resolves: rhbz#1751295: (2) When sync-repl is enabled, slapi-nis can deadlock during retrochanglog trimming\n- Resolves: rhbz#1768156: ERR - schemacompat - map rdlock: old way MAP_MONITOR_DISABLED\n\nsofthsm\n[2.6.0-3]\n- Fixes: rhbz#1834909 - softhsm use-after-free on process exit\n- Synchronize the final fix with Fedora\n\n[2.6.0-2]\n- Fixes: rhbz#1834909 - softhsm use-after-free on process exit\n\n[2.6.0-1]\n- Fixes: rhbz#1818877 - rebase to softhsm 2.6.0+\n- Fixes: rhbz#1701233 - support setting supported signature methods on the token",
  "id": "ELSA-2020-4670",
  "ovalId": "oval:com.oracle.elsa:def:20204670",
  "source": "oracle_linux",
  "title": "ELSA-2020-4670:  idm:DL1 and idm:client security, bug fix, and enhancement update (MODERATE)",
  "url": "https://linux.oracle.com/errata/ELSA-2020-4670.html"
}