<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
<html lang="en" style='--code-editor-font: var(--default-mono-font, "GitLab Mono"), JetBrains Mono, Menlo, DejaVu Sans Mono, Liberation Mono, Consolas, Ubuntu Mono, Courier New, andale mono, lucida console, monospace;'>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
<title>
GitLab
</title>
<style data-premailer="ignore" type="text/css">
a { color: #1068bf; }
</style>
<style>img {
max-width: 100%; height: auto;
}
body {
font-size: .875rem;
}
body {
-webkit-text-shadow: rgba(255,255,255,.01) 0 0 1px;
}
body {
font-family: "GitLab Sans",-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Noto Sans",Ubuntu,Cantarell,"Helvetica Neue",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji"; font-size: inherit;
}
</style>
</head>
<body style='font-size: inherit; -webkit-text-shadow: rgba(255,255,255,.01) 0 0 1px; font-family: "GitLab Sans",-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Noto Sans",Ubuntu,Cantarell,"Helvetica Neue",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji";'>
<div class="content">
<h3 style="margin-top: 20px; margin-bottom: 10px;">
Timo Aaltonen pushed to branch upstream at <a href="https://salsa.debian.org/freeipa-team/freeipa">FreeIPA packaging / freeipa</a>
</h3>
<h4 style="margin-top: 10px; margin-bottom: 10px;">
Commits:
</h4>
<ul>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/freeipa-team/freeipa/-/commit/cf84a22228460957f578ac102f02516febe13f92">cf84a222</a></strong>
<div>
<span> by Alexander Bokovoy </span> <i> at 2025-01-15T11:15:09+01:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>Unify use of option parsers
Do not use direct optparse references, instead import IPAOptionParser
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/freeipa-team/freeipa/-/commit/3b38efe75865d0696829b4f26572575a8e74ddce">3b38efe7</a></strong>
<div>
<span> by Alexander Bokovoy </span> <i> at 2025-01-15T11:15:39+01:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>ipa tools: remove sensitive material from the commandline
When command line tools accept passwords, remove them from the command
line so that they don't get visible in '/proc/pid/commandline'.
There is no common method to access the original ARGV vector and modify
it from Python. Since this mostly affects Linux systems where IPA
services run, we expect use of GNU libc and thus can rely on internal
glibc symbols. If they aren't available, the code will skip removing
passwords.
Fixes: CVE-2024-11029
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/freeipa-team/freeipa/-/commit/7a5a10b6bf2e3eafd4b69362ffaece39791be2a8">7a5a10b6</a></strong>
<div>
<span> by Sumit Bose </span> <i> at 2025-01-15T11:15:39+01:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>ipa-otpd: use oidc_child's --client-secret-stdin option
To remove the client secret from the command line where it would be
visible e.g. when calling ps it is now passed via stdin to oidc_child.
Fixes: CVE-2024-11029
Signed-off-by: Sumit Bose <sbose@redhat.com>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/freeipa-team/freeipa/-/commit/f33a0e8e712b2fc173408a26441d73f47e7348db">f33a0e8e</a></strong>
<div>
<span> by Antonio Torres </span> <i> at 2025-01-15T12:01:25+01:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>Become IPA 4.12.3
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/freeipa-team/freeipa/-/commit/6ae52a2fb451bbe57a4f0c584e14bca0274b85e8">6ae52a2f</a></strong>
<div>
<span> by Julien Rische </span> <i> at 2025-06-17T09:08:19+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>kdb: keep ipadb_get_connection() from succeeding with null LDAP context
The final call to ipadb_reinit_mspac() in ipadb_get_connection() is not
considered essential for the function to succeed, as there might be
cases where the required pieces of information to generate PACs are not
yet configured in the database. However, in environments where 389ds is
overwhelmed, the LDAP connection established at the beginning of
ipadb_get_connection() might already be lost while executing
ipadb_reinit_mspac().
Connection errors were not distinguished from configuration errors,
which could result in ipadb_get_connection() succeeding while the LDAP
context is set to null, leading to a KDC crash on the next LDAP request.
ipadb_get_connection() now explicitly checks the value of the LDAP
context before returning.
Fixes: https://pagure.io/freeipa/issue/9777
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Rafael Guterres Jeffman <rjeffman@redhat.com>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/freeipa-team/freeipa/-/commit/e8c410ae5f7cdd36fecba66713ca94bd47465122">e8c410ae</a></strong>
<div>
<span> by Rob Crittenden </span> <i> at 2025-06-17T09:11:34+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>Set krbCanonicalName=admin@REALM on the admin user
The admin must always own this name. If another entry has this
value set then remove it.
There is a uniqueness plugin for this attribute so the only two
possibilities are:
- no entry has this value set
- the admin user has this value set
- a different entry has the value set
Still, for robustness purposes, the upgrade plugin will handle
more entries.
Signed-off-by: Rob Crittenden <rcritten@redhat.com>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/freeipa-team/freeipa/-/commit/f2fc367fb00193a8ca8a1f22786fccd6b0024dac">f2fc367f</a></strong>
<div>
<span> by Antonio Torres </span> <i> at 2025-06-17T09:14:30+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>Become IPA 4.12.4
</pre>
</li>
</ul>
<h4 style="margin-top: 10px; margin-bottom: 10px;">
31 changed files:
</h4>
<ul>
<li class="file-stats">
<a href="#438c41c93b7f0c8b476c65c3eb42284f234bd810">
VERSION.m4
</a>
</li>
<li class="file-stats">
<a href="#c353f68be99056278f9117d02e4294a759188b14">
daemons/ipa-kdb/ipa_kdb.c
</a>
</li>
<li class="file-stats">
<a href="#c9e2f967c86354c24d009d045e5823b59b0d49c7">
daemons/ipa-otpd/oauth2.c
</a>
</li>
<li class="file-stats">
<a href="#cd2fcd7ca09773520dde046fee4fac564e5584c4">
install/oddjob/com.redhat.idm.trust-fetch-domains.in
</a>
</li>
<li class="file-stats">
<a href="#1b0815535199b14696842a1d17bc4db7b6c9f9ee">
install/share/bootstrap-template.ldif
</a>
</li>
<li class="file-stats">
<a href="#026f64c9f78ecdf4cf6aafb61693b0888559ccbd">
install/tools/ipa-adtrust-install.in
</a>
</li>
<li class="file-stats">
<a href="#3c5f50edcf2a57552e09679a4cc79e374cee8ae4">
install/tools/ipa-ca-install.in
</a>
</li>
<li class="file-stats">
<a href="#665b8225482d84855294e5a343f7b58868256811">
install/tools/ipa-compat-manage.in
</a>
</li>
<li class="file-stats">
<a href="#26db5858a3468bf44df52fc4cf8fe2515e6d4994">
install/tools/ipa-csreplica-manage.in
</a>
</li>
<li class="file-stats">
<a href="#f4567ba6a3e7e86ec3a88adbb42d576f9cae6ee3">
install/tools/ipa-managed-entries.in
</a>
</li>
<li class="file-stats">
<a href="#852f556964b5c045d4afcba3e4c6ba33cb6ed983">
install/tools/ipa-replica-conncheck.in
</a>
</li>
<li class="file-stats">
<a href="#b583b98d22c00d7d48dd585e74bb6cc20d2d0024">
install/tools/ipa-replica-manage.in
</a>
</li>
<li class="file-stats">
<a href="#232a2659f622fb3fd72d3023954c51f1ea5f97f5">
install/updates/90-post_upgrade_plugins.update
</a>
</li>
<li class="file-stats">
<a href="#fd91e0194095fd5702c1e442d85092260ebc86e1">
ipaclient/install/ipa_client_automount.py
</a>
</li>
<li class="file-stats">
<a href="#eb134ad3889c2e35b2ebe6043e06e7558dd5c19b">
ipaclient/install/ipa_client_samba.py
</a>
</li>
<li class="file-stats">
<a href="#5331a0eb592d10847abf58fc280d6841632ffed4">
ipalib/cli.py
</a>
</li>
<li class="file-stats">
<a href="#bb91e29c513d9f052b26a9cf9054378eae0c659d">
ipalib/plugable.py
</a>
</li>
<li class="file-stats">
<a href="#1b35cd35bbdbfd95482da2dcd5e1704c6e339d13">
ipapython/admintool.py
</a>
</li>
<li class="file-stats">
<a href="#93b5f4c8aa02e1aee97311198be82c73a64515e6">
ipapython/config.py
</a>
</li>
<li class="file-stats">
<a href="#4404e03242d0fdf6c1beb3f5943a4809149d7874">
ipapython/install/cli.py
</a>
</li>
<li class="file-stats">
<a href="#0f53722c734370cfca87f5e8c41f95db4d94351e">
ipaserver/install/ipa_acme_manage.py
</a>
</li>
<li class="file-stats">
<a href="#209675f0f945497dbc7c452814319d0233d43745">
ipaserver/install/ipa_backup.py
</a>
</li>
<li class="file-stats">
<a href="#d64bd7c195d19b31ebbbe1d2f932ab0b8c19306d">
ipaserver/install/ipa_cacert_manage.py
</a>
</li>
<li class="file-stats">
<a href="#e518de52ae1d50e7281e2ba1456d0acc3e2c0085">
ipaserver/install/ipa_kra_install.py
</a>
</li>
<li class="file-stats">
<a href="#8bd3863386819e103e56aa9bff612a4100b12a19">
ipaserver/install/ipa_migrate.py
</a>
</li>
<li class="file-stats">
<a href="#d515bf668c89d4f8d04e9bca853cee35782d5134">
ipaserver/install/ipa_restore.py
</a>
</li>
<li class="file-stats">
<a href="#838dfa27ab778e0866abf52d3f8399c876e96709">
ipaserver/install/ipa_server_certinstall.py
</a>
</li>
<li class="file-stats">
<a href="#d3d6ff66240d462c4ad200daa844d856b1285966">
<span class="new-file">
+
ipaserver/install/plugins/add_admin_krbcanonicalname.py
</span>
</a>
</li>
<li class="file-stats">
<a href="#7aa4edd37b2cd14cd065a080b18ed51d7b9c90ab">
ipatests/i18n.py
</a>
</li>
<li class="file-stats">
<a href="#bdf5784502d0c6f2cbe8a15452a7e25758ff9b81">
ipatests/test_integration/test_commands.py
</a>
</li>
<li class="file-stats">
<a href="#580e29605dd895155b4f664871c5d2e2feb710a4">
makeapi.in
</a>
</li>
</ul>
<h5 style="margin-top: 10px; margin-bottom: 10px; font-size: .875rem;">
The diff was not included because it is too large.
</h5>
</div>
<div class="footer" style="margin-top: 10px;">
<p style="font-size: small; color: #626168;">
—
<br>
<a href="https://salsa.debian.org/freeipa-team/freeipa/-/compare/c7da7e0dc979c2ecd834a0727114f53cdf878297...f2fc367fb00193a8ca8a1f22786fccd6b0024dac">View it on GitLab</a>.
<br>
You're receiving this email because of your account on <a target="_blank" rel="noopener noreferrer" href="https://salsa.debian.org">salsa.debian.org</a>. <a href="https://salsa.debian.org/-/profile/notifications" target="_blank" rel="noopener noreferrer" class="mng-notif-link">Manage all notifications</a> · <a href="https://salsa.debian.org/help" target="_blank" rel="noopener noreferrer" class="help-link">Help</a>
</p>
</div>
</body>
</html>