[ALSA-2026:83460] Critical: idm:DL1 security, bug fix, and enhancement update
Type:
security
Severity:
critical
Release date:
2026-10-16
Description:
AlmaLinux Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. Security Fix(es): * ipa: FreeIPA: Unauthenticated DoS in `/ipa/i18n_messages` via Unbounded Request Body Read (CVE-2026-73198) * ipa: FreeIPA: Unauthenticated DoS in `/ipa/migration/migration.py` via Unbounded Request Body Read (CVE-2026-73197) * FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships (CVE-2026-11861) * freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL (CVE-2026-18147) * freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes (CVE-2026-19550) * ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore (CVE-2026-13097) * ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI (CVE-2026-76578) * freeIPA: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service (CVE-2026-79678) Bug Fix(es) and Enhancement(s): * Fix ipatests for kdcproxy after CVE-2025-59088 fix [almalinux-8.10.z] (JIRA:AlmaLinux-129966) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References:
Updated packages listed below:
Architecture Package Checksum
aarch64 softhsm-devel-2.6.0-5.module_el8.6.0+2881+2f24dc92.aarch64.rpm 41ccba15598559f2c4ce3d45740d258ac1e4d0de8640d2654774997e3b67e0c5
aarch64 ipa-server-4.9.13-21.module_el8.10.0+4302+2d2000af.3.aarch64.rpm 733ae2d568122a50e9a94527e306cc94f92c3cc1dc542acb5785dcc30503768a
aarch64 opendnssec-2.1.7-2.module_el8.10.0+3980+d78e8e90.aarch64.rpm 7a6b126e78c5f05e44b87315375c826dd2cebff2799860e87d1eceb85304458a
aarch64 softhsm-2.6.0-5.module_el8.6.0+2881+2f24dc92.aarch64.rpm a197e40c5401d2d7385eae40692efb1bf5ff59045f9cf9b24373732010966126
aarch64 bind-dyndb-ldap-11.6-6.module_el8.10.0+3980+d78e8e90.aarch64.rpm aafd855145033ee07a7a867199ad1e03176e2b89afd38b2802ca0390a204aba0
aarch64 slapi-nis-0.60.0-4.module_el8.10.0+3844+20e075e5.alma.1.aarch64.rpm c9254b81dc1f04fad69e0bfa87873c8f74e21da97fd5bc8d30e7e7073d496092
aarch64 ipa-client-samba-4.9.13-21.module_el8.10.0+4302+2d2000af.3.aarch64.rpm dceb6731d97ed5e4b1c0f38b4c903c9c3301769e1154eec273d144ec75d037ec
aarch64 ipa-client-4.9.13-21.module_el8.10.0+4302+2d2000af.3.aarch64.rpm f414dba41cf55e8992d294f70104168e4b3c08af6516da6da9357a8a783e61fb
aarch64 ipa-client-epn-4.9.13-21.module_el8.10.0+4302+2d2000af.3.aarch64.rpm f6ff86205e39575304819318e2274c22103c961b6234da98e4d5d04a0b300001
aarch64 ipa-server-trust-ad-4.9.13-21.module_el8.10.0+4302+2d2000af.3.aarch64.rpm fb4eec2c1cfb02cce2659a92a5b1ec893449ad329893507b9ac9f9f4218bbbb2
noarch python3-ipatests-4.9.13-21.module_el8.10.0+4302+2d2000af.3.noarch.rpm 0dc892199eff5db7ff0d4f18fbc8fd1f9ea16661bf474c6e54d5c1d0a7e3f831
noarch python3-qrcode-5.3-1.module_el8.10.0+3942+63b39a46.noarch.rpm 109f98be9cf4358f1892e43363dc3d1163173bd6f1f58365f9fc153b2fbad8d7
noarch ipa-common-4.9.13-21.module_el8.10.0+4302+2d2000af.3.noarch.rpm 156241d00000dcd9e90814ff286b235db01c3068f4cc58859482d5c064b44887
noarch ipa-python-compat-4.9.13-21.module_el8.10.0+4302+2d2000af.3.noarch.rpm 226e310c507101641e22a697605beadb0c530cb63a9b9a124d9e12388e91d6c4
noarch ipa-selinux-4.9.13-21.module_el8.10.0+4302+2d2000af.3.noarch.rpm 2a6a71e997b99efdf6f849349bf080046d329744213ab12f63069bc661cd15ee
noarch python3-jwcrypto-0.5.0-2.module_el8.10.0+3844+20e075e5.noarch.rpm 3827ec1b1ddb7641307d2aae1a6e9d8a9634a2f4e2f2ee7e8ba866903524734b
noarch python3-custodia-0.6.0-3.module_el8.6.0+2881+2f24dc92.noarch.rpm 416415f024d2f5fd5573a04b9b3d4c4717e07b8f72999773e10bf94d076a7296
noarch ipa-server-dns-4.9.13-21.module_el8.10.0+4302+2d2000af.3.noarch.rpm 41ac26e437e356ffae3f1853af16bfe2a1b506b069def7ecdd8184bc1ab8da84
noarch ipa-healthcheck-core-0.12-6.module_el8.10.0+4036+84b152d9.noarch.rpm 4df8324e9302806cbeb5acc90e44e2874471344385d45f9d684dcc297dd5e3ef
noarch ipa-healthcheck-0.12-6.module_el8.10.0+4036+84b152d9.noarch.rpm 59f7474a67cbc965bd0c360b4385395b89d1a12cf7015fcd6b16abe44ce85b0b
noarch python3-pyusb-1.0.0-9.1.module_el8.7.0+3349+cfeff52e.noarch.rpm 5f45866e2459f1c9a0b969263baab4ffed264d2998456658cafd554de6300cfa
noarch python3-ipalib-4.9.13-21.module_el8.10.0+4302+2d2000af.3.noarch.rpm 64678dd285c53aca540cfc08f5ce969e701f5382ac5010e25385f49d9a37aad0
noarch python3-yubico-1.3.2-9.1.module_el8.7.0+3349+cfeff52e.noarch.rpm 68b28b3fb94f5026730feca1a1c3feb64c06ad5601a7cf8befb4e704510edd73
noarch python3-kdcproxy-0.4-5.module_el8.10.0+4069+1d9eaa78.2.noarch.rpm 69ec0752aefcdcdb6ea120d9ff9f0c876188057697d885b1509069dd6ceff7a4
noarch python3-ipaserver-4.9.13-21.module_el8.10.0+4302+2d2000af.3.noarch.rpm 6e5b188f929fec264a8166ce08465200a08aab493312263f5c94252b8266c70f
noarch python3-qrcode-core-5.3-1.module_el8.10.0+3942+63b39a46.noarch.rpm 7a7706a06f589393224f10f99b9aef62d5559f02e1c97754b86d2763dfefa70d
noarch ipa-server-common-4.9.13-21.module_el8.10.0+4302+2d2000af.3.noarch.rpm 7ab3b7165531371d213aeb17e9ba8f415d8bd39db86d7025f9c24629d9d4ac0d
noarch python3-ipaclient-4.9.13-21.module_el8.10.0+4302+2d2000af.3.noarch.rpm a75196c811e4c92062ecf5027c037627672437a94923e6639bccc830063f6a4c
noarch custodia-0.6.0-3.module_el8.6.0+2881+2f24dc92.noarch.rpm c2ce1591d7ce3710fbdf3aa666fc69e9d06a3e691f36228836771cc64886b772
noarch ipa-client-common-4.9.13-21.module_el8.10.0+4302+2d2000af.3.noarch.rpm def064970130b4ef69b10806757629be2ca0cbe0a97b04006c8aac458a71d4d6
ppc64le softhsm-devel-2.6.0-5.module_el8.6.0+2881+2f24dc92.ppc64le.rpm 0d565eba7dc881927d07fa580d8bc05ad7a4a8cc82217ef7d98c5f466d7195a1
ppc64le slapi-nis-0.60.0-4.module_el8.10.0+3844+20e075e5.alma.1.ppc64le.rpm 327532fa7a0a9722c3f491aa9ff783fb19718ba7b392b5cc2451f13a3a36629d
ppc64le bind-dyndb-ldap-11.6-6.module_el8.10.0+3980+d78e8e90.ppc64le.rpm 32f71db345ad560a66d54f2f2d134909129a85a43c76b080b22379d5f22c10ee
ppc64le ipa-client-4.9.13-21.module_el8.10.0+4302+2d2000af.3.ppc64le.rpm 4e0970c0ea9bf9d0eb6930b61d0629a80428cfcbab8fd39f90b6a697a7f5e223
ppc64le ipa-server-trust-ad-4.9.13-21.module_el8.10.0+4302+2d2000af.3.ppc64le.rpm 9555e52c44e02a67b01fccff719bababe03fcfb7fbed3c50dbcdb2465aef313f
ppc64le softhsm-2.6.0-5.module_el8.6.0+2881+2f24dc92.ppc64le.rpm 9e7906c48f5b221582d8e4a3ab0400317bacccf5f83827b295c73cc6e75a3dac
ppc64le ipa-server-4.9.13-21.module_el8.10.0+4302+2d2000af.3.ppc64le.rpm 9eb3c187a490fac2b981059ef5797a6a00a7d513cc600518104ed2c9f9512870
ppc64le opendnssec-2.1.7-2.module_el8.10.0+3980+d78e8e90.ppc64le.rpm d26d57cb78cf864120b176a60b8aac77f46e7c65ac62e135ee2368156426f096
ppc64le ipa-client-samba-4.9.13-21.module_el8.10.0+4302+2d2000af.3.ppc64le.rpm d45cff0832405b0a3bc608dd80c868fa96014de5954a6d230be35283ded37a3a
ppc64le ipa-client-epn-4.9.13-21.module_el8.10.0+4302+2d2000af.3.ppc64le.rpm d600003454c742909189688cf19150c098f1d3f6b3f354989ee1ba8c5527ae25
s390x bind-dyndb-ldap-11.6-6.module_el8.10.0+3980+d78e8e90.s390x.rpm 2c700ccfc92d7dea4c2bd2b386a200dbe70a6d9e88144470c331345f4694c1b3
s390x ipa-server-trust-ad-4.9.13-21.module_el8.10.0+4302+2d2000af.3.s390x.rpm 3730b263d8336c32547fba3142069b9e4c75d2a06addad8646c37d7c4a53159d
s390x ipa-client-4.9.13-21.module_el8.10.0+4302+2d2000af.3.s390x.rpm 6a3a34ecf7a5073f9788d49440e96c719648b91c131249bf7327a6f610482f95
s390x ipa-client-epn-4.9.13-21.module_el8.10.0+4302+2d2000af.3.s390x.rpm 8df8b18ce2255b014df2e562dbc2872b33491571252163e7669c820d82f2e505
s390x softhsm-devel-2.6.0-5.module_el8.6.0+3031+2f24dc92.s390x.rpm 99b0ac3696d5de6fbbd0e2bb5882b9a36feef44b0fcb4f42dd82963f3077f8ab
s390x softhsm-2.6.0-5.module_el8.6.0+3031+2f24dc92.s390x.rpm ad706f5e338373e1c6880dce46ce69f7e82ebf416e464ec0abc5c316b27306a1
s390x ipa-server-4.9.13-21.module_el8.10.0+4302+2d2000af.3.s390x.rpm b2ea25c67bf28e3f72db15b45fd0de7a392ca08e390535b9eefbfd57cd79daec
s390x slapi-nis-0.60.0-4.module_el8.10.0+3844+20e075e5.alma.1.s390x.rpm bfc1ed725a4b9c6d74b4b99b8b4dd82647f4f1a4e958e8e455cb5762aae70113
s390x opendnssec-2.1.7-2.module_el8.10.0+3980+d78e8e90.s390x.rpm d54df6918ca5a7264f2793ef6d6b2a42884458f030404ce47a19cb6abbfdb9cf
s390x ipa-client-samba-4.9.13-21.module_el8.10.0+4302+2d2000af.3.s390x.rpm e491308aa9878b62f6a031964ea36ba5077e7ffca74cb7ccca29834c4a618d5e
x86_64 ipa-server-trust-ad-4.9.13-21.module_el8.10.0+4302+2d2000af.3.x86_64.rpm 1b75458b0313664a1af372bb657c21556df1eab6d090745e3a331c9f94957077
x86_64 bind-dyndb-ldap-11.6-6.module_el8.10.0+3980+d78e8e90.x86_64.rpm 270531af28eff35f4329f317ed1c1614a1af7af89de516daa80dc5ffdd0bf547
x86_64 slapi-nis-0.60.0-4.module_el8.10.0+3844+20e075e5.alma.1.x86_64.rpm 2f1baf70e48ecb4049b6c17d28d695c43ffd4cb2e67cd490266c669b7d181304
x86_64 ipa-client-samba-4.9.13-21.module_el8.10.0+4302+2d2000af.3.x86_64.rpm 41baf7b5cea251cd2c9c5df0f5aa0ef85812b23af3ab3a58872e7e324954a133
x86_64 softhsm-2.6.0-5.module_el8.6.0+2881+2f24dc92.x86_64.rpm 811210ae191e3e43bd6c050dc62929aa8ceffa91282ea200b96845b8a1425de2
x86_64 ipa-server-4.9.13-21.module_el8.10.0+4302+2d2000af.3.x86_64.rpm 92042bf5fac7411f48b87cf0957f5e07cfc15dfb838b107d5008349a66465e35
x86_64 opendnssec-2.1.7-2.module_el8.10.0+3980+d78e8e90.x86_64.rpm bce5ab591c19f77a9834eee97389c4523d782e50fb58102000d7ae17cb49e77f
x86_64 ipa-client-4.9.13-21.module_el8.10.0+4302+2d2000af.3.x86_64.rpm d83f6cf3f1f658dbca1bdd1846dd3bf1a6a699ed41829ce51174feb9a3e9701f
x86_64 ipa-client-epn-4.9.13-21.module_el8.10.0+4302+2d2000af.3.x86_64.rpm d8e3713d39ec09a1ff3fe2b8a845d04d7421366461a6c2d1f4091b27d6e8a781
x86_64 softhsm-devel-2.6.0-5.module_el8.6.0+2881+2f24dc92.x86_64.rpm f004bec0bb3248d09ad4724c0c8acfc9cc5466028bcd72bb63d52490efb4bfe8
Notes:
This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.