[ALSA-2026:70564] Critical: ipa security, bug fix, and enhancement update
Type:
security
Severity:
critical
Release date:
2026-09-25
Description:
AlmaLinux Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. Security Fix(es): * ipa: FreeIPA: Unauthenticated DoS in `/ipa/i18n_messages` via Unbounded Request Body Read (CVE-2026-73198) * ipa: FreeIPA: Unauthenticated DoS in `/ipa/migration/migration.py` via Unbounded Request Body Read (CVE-2026-73197) * FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships (CVE-2026-11861) * freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL (CVE-2026-18147) * freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes (CVE-2026-19550) * ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore (CVE-2026-13097) * ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI (CVE-2026-76578) * freeIPA: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service (CVE-2026-79678) Bug Fix(es) and Enhancement(s): * [Cursor Automated] Include latest fixes in python3-ipatests package [AlmaLinux9.8] (JIRA:AlmaLinux-170987) * WebUI Hardening [almalinux-9.8.z] (JIRA:AlmaLinux-238511) * ipa-otptoken-import hardening [almalinux-9.8.z] (JIRA:AlmaLinux-238519) * host-mod: handle the password attribute when set with --setattr userpassword= [almalinux-9.8.z] (JIRA:AlmaLinux-238523) * ipa env: support only simple * wildcard [almalinux-9.8.z] (JIRA:AlmaLinux-238527) * ipa-epn: drop_privileges method is mixing uid and gid [almalinux-9.8.z] (JIRA:AlmaLinux-238674) * ipa-migrate: require Replication Administrator privilege [almalinux-9.8.z] (JIRA:AlmaLinux-238677) * ipa-migrate tool is renaming host records & host info in automount information [almalinux-9.8.z] (JIRA:AlmaLinux-240767) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References:
Updated packages listed below:
Architecture Package Checksum
aarch64 ipa-client-samba-4.13.4-1.el9_8.aarch64.rpm 15cb3d25d10c0656a53591302372a948679f78719b0b7c9ac84e834b7cce8a7f
aarch64 ipa-server-4.13.4-1.el9_8.aarch64.rpm 384c73a6138eff5678bac95097156adbde3cee49de58d2520af5998b8793f15d
aarch64 ipa-server-encrypted-dns-4.13.4-1.el9_8.aarch64.rpm 97d39d227ace444037f4efdf08808f1f2b617a32abfeb7bd58a6b4f6f297fe9e
aarch64 ipa-client-4.13.4-1.el9_8.aarch64.rpm 99cf367bff707b6b8792fcf2e50dec77c9a42e7e19205bf6892de8915c72a8c1
aarch64 ipa-client-encrypted-dns-4.13.4-1.el9_8.aarch64.rpm bea9d0c8851edce1ccd2e0d02126f26bd45f1f3f3a1f1e67712a1cfdd4860bb3
aarch64 ipa-client-epn-4.13.4-1.el9_8.aarch64.rpm cb92ea7061bb04149bd101933bb8c027a16b889cefde8449cd70a7361c6f4007
aarch64 ipa-server-trust-ad-4.13.4-1.el9_8.aarch64.rpm fdb5ed86c58e7c9b247084a29095d6b552b9e9a4d5d4e18bb2d615c8e1d354a5
noarch python3-ipatests-4.13.4-1.el9_8.noarch.rpm 06db0bac21c10e74e426e3f9d48fdfa4abcb65e373a0087a66db13989f728e6f
noarch ipa-server-common-4.13.4-1.el9_8.noarch.rpm 176910619bf6bc9d20a1e1804178207a122659c795374cb315661e8d0649299b
noarch ipa-selinux-4.13.4-1.el9_8.noarch.rpm 1fa3e8d81b72faa1f444d8479c9c02fe54062e9e5f430e0b15e083345a7a9d3a
noarch python3-ipalib-4.13.4-1.el9_8.noarch.rpm 220e3bcd406c5ecf0a5b57a1be697689598dea63f0591f59222720cfd28a0cdf
noarch ipa-selinux-luna-4.13.4-1.el9_8.noarch.rpm 390683cd768481143a2347673931fef899c31d2666b4435bb2d88c05b16f1a6a
noarch python3-ipaserver-4.13.4-1.el9_8.noarch.rpm 3c1b8ce255ccf6e9e9aa58e2d4004b353b78bd126de8f8df3b9670044648da55
noarch ipa-selinux-nfast-4.13.4-1.el9_8.noarch.rpm 3e476049592688b3d4b2f653f3b02f0687f3cfb7b86dcc10b7f927f9454a445f
noarch ipa-server-dns-4.13.4-1.el9_8.noarch.rpm 6f7a1877cfa120907e38fd95a7c48fcab160c62b3c98cd05000715823a0d0eb8
noarch ipa-common-4.13.4-1.el9_8.noarch.rpm c9714dbdaaeffc5692e95fa070fc85ee2371c5437b0a32630e462486ec3658f7
noarch python3-ipaclient-4.13.4-1.el9_8.noarch.rpm d107d5b70fd5d9e19de8659e5c30d434f8386be69f0ce43eee94d843c05e1e47
noarch ipa-client-common-4.13.4-1.el9_8.noarch.rpm da3add48f06d2af1a8f2c662c0f60d48888a6c7e1b83aff7f164f3c31577fadf
ppc64le ipa-client-encrypted-dns-4.13.4-1.el9_8.ppc64le.rpm 6961d70eacef2fd6825259d342fd40cdb02cc9166fb9668cdcafdd14af140fa2
ppc64le ipa-server-4.13.4-1.el9_8.ppc64le.rpm 75f7b859dc61eeec0d96e8c4e455fcff984a7348e7dfc1a3d83449b7cf056dd7
ppc64le ipa-server-trust-ad-4.13.4-1.el9_8.ppc64le.rpm 8898b5c828f5ea99e47e3763f0403a04fbda36e622900e9682fd02ba3c58b014
ppc64le ipa-client-samba-4.13.4-1.el9_8.ppc64le.rpm a5a1805117d16a7752a6815617e7672f4a751f5ac4b4e07417575e6dab578b3d
ppc64le ipa-server-encrypted-dns-4.13.4-1.el9_8.ppc64le.rpm ba78142d726b2c915d3423be59a1481b1ea74d8392bb8b8aec120406a947620b
ppc64le ipa-client-4.13.4-1.el9_8.ppc64le.rpm e7266a603d08570f14764f8bd2d8c53c8fd8d243dae131ac6ada523d7cf826ba
ppc64le ipa-client-epn-4.13.4-1.el9_8.ppc64le.rpm fc4675abe7e6556fb792e4cb2446601ed7eb2d1a0beadb3490c16dd842596cbd
s390x ipa-server-encrypted-dns-4.13.4-1.el9_8.s390x.rpm 11b980f1ffca069003b9861bd94dd85c4a315b6c0e2a0609ecccd2568766331c
s390x ipa-client-samba-4.13.4-1.el9_8.s390x.rpm 31d376c97106784537c53a8ec9d91367faaa624bc1acff241f89821998172043
s390x ipa-client-encrypted-dns-4.13.4-1.el9_8.s390x.rpm 395d8c8366a94444b7ed99ebeeeec8d94e62e7c632e19f9c457ed15d56850dac
s390x ipa-server-trust-ad-4.13.4-1.el9_8.s390x.rpm 4b44ab0138e50bc4910d87327667edc32fa07be77c60eacdd5fddb3872417f7f
s390x ipa-client-4.13.4-1.el9_8.s390x.rpm 6980a6a817571e63b615010d2e49a8222d6f5a9b5c162c5a6facc8186077de1f
s390x ipa-server-4.13.4-1.el9_8.s390x.rpm 6d301a66b4f126d34c399b28eae1143846b7d3fc78ef5a5d8114272e57b35352
s390x ipa-client-epn-4.13.4-1.el9_8.s390x.rpm bd807804e5b9d5837a6b46dfbaa84d1b3e0d7c97ebbfc0de6e42914c1fb50e7f
x86_64 ipa-server-trust-ad-4.13.4-1.el9_8.x86_64.rpm 056397aed106ee61e232978cb3dfdaf5dacf8d168d4c58b6dd9ca7c94615c6b6
x86_64 ipa-client-epn-4.13.4-1.el9_8.x86_64.rpm 0b17541eb4db55a91303eedf515e4bff406f7ccff2781614c284c0f385bb9eae
x86_64 ipa-client-samba-4.13.4-1.el9_8.x86_64.rpm 1cfd7d5728966797055eda12ca3a009d1724f699432daf50205e2c8d4f81ba89
x86_64 ipa-server-4.13.4-1.el9_8.x86_64.rpm 1ebb1d213de4b2f960a382ed2b637599e2b397972736921ace7e860acadc46f1
x86_64 ipa-server-encrypted-dns-4.13.4-1.el9_8.x86_64.rpm 94fca7b190a2a15c4cd12b66ec8f07408f95ba358e87bbb19f3d39d098c0d690
x86_64 ipa-client-4.13.4-1.el9_8.x86_64.rpm b42896d01384286f0210ef85adc9be0be72b85f50c450b72a5900286c59af046
x86_64 ipa-client-encrypted-dns-4.13.4-1.el9_8.x86_64.rpm ff56e15f0aed98008ac671162a7392cd0d377f8d19b64f851751624fd674e345
Notes:
This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.