[El-errata] ELSA-2026-72279 Critical: Oracle Linux 10 ipa security, bug fix, and enhancement update

[Errata Announcements for Oracle Linux]

Oracle Linux Security Advisory ELSA-2026-72279

http://linux.oracle.com/errata/ELSA-2026-72279.html

The following updated rpms for Oracle Linux 10 have been uploaded to the Unbreakable Linux Network:

x86_64:
ipa-client-4.13.4-1.0.1.el10_2.x86_64.rpm
ipa-client-common-4.13.4-1.0.1.el10_2.noarch.rpm
ipa-client-encrypted-dns-4.13.4-1.0.1.el10_2.x86_64.rpm
ipa-client-epn-4.13.4-1.0.1.el10_2.x86_64.rpm
ipa-client-samba-4.13.4-1.0.1.el10_2.x86_64.rpm
ipa-common-4.13.4-1.0.1.el10_2.noarch.rpm
ipa-selinux-4.13.4-1.0.1.el10_2.noarch.rpm
ipa-selinux-luna-4.13.4-1.0.1.el10_2.noarch.rpm
ipa-selinux-nfast-4.13.4-1.0.1.el10_2.noarch.rpm
ipa-server-4.13.4-1.0.1.el10_2.x86_64.rpm
ipa-server-common-4.13.4-1.0.1.el10_2.noarch.rpm
ipa-server-dns-4.13.4-1.0.1.el10_2.noarch.rpm
ipa-server-encrypted-dns-4.13.4-1.0.1.el10_2.x86_64.rpm
ipa-server-trust-ad-4.13.4-1.0.1.el10_2.x86_64.rpm
python3-ipaclient-4.13.4-1.0.1.el10_2.noarch.rpm
python3-ipalib-4.13.4-1.0.1.el10_2.noarch.rpm
python3-ipaserver-4.13.4-1.0.1.el10_2.noarch.rpm
python3-ipatests-4.13.4-1.0.1.el10_2.noarch.rpm

aarch64:
ipa-client-4.13.4-1.0.1.el10_2.aarch64.rpm
ipa-client-common-4.13.4-1.0.1.el10_2.noarch.rpm
ipa-client-encrypted-dns-4.13.4-1.0.1.el10_2.aarch64.rpm
ipa-client-epn-4.13.4-1.0.1.el10_2.aarch64.rpm
ipa-client-samba-4.13.4-1.0.1.el10_2.aarch64.rpm
ipa-common-4.13.4-1.0.1.el10_2.noarch.rpm
ipa-selinux-4.13.4-1.0.1.el10_2.noarch.rpm
ipa-selinux-luna-4.13.4-1.0.1.el10_2.noarch.rpm
ipa-selinux-nfast-4.13.4-1.0.1.el10_2.noarch.rpm
ipa-server-4.13.4-1.0.1.el10_2.aarch64.rpm
ipa-server-common-4.13.4-1.0.1.el10_2.noarch.rpm
ipa-server-dns-4.13.4-1.0.1.el10_2.noarch.rpm
ipa-server-encrypted-dns-4.13.4-1.0.1.el10_2.aarch64.rpm
ipa-server-trust-ad-4.13.4-1.0.1.el10_2.aarch64.rpm
python3-ipaclient-4.13.4-1.0.1.el10_2.noarch.rpm
python3-ipalib-4.13.4-1.0.1.el10_2.noarch.rpm
python3-ipaserver-4.13.4-1.0.1.el10_2.noarch.rpm
python3-ipatests-4.13.4-1.0.1.el10_2.noarch.rpm


SRPMS:
http://oss.oracle.com/ol10/SRPMS-updates/ipa-4.13.4-1.0.1.el10_2.src.rpm

Related CVEs:

CVE-2026-11861
CVE-2026-13097
CVE-2026-18147
CVE-2026-19550
CVE-2026-73197
CVE-2026-73198
CVE-2026-76578
CVE-2026-79678




Description of changes:

[4.13.4-1.0.1]
- Set IPAPLATFORM=rhel when build on Oracle Linux [Orabug: 29516674]
- Add bind to ipa-server-common Requires [Orabug: 36518596]

[4.13.4-1]
- Resolves: RHEL-248199 CVE-2026-79678 ipa: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service
- Resolves: RHEL-245626 CVE-2026-19550 ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes [rhel-10.2.z]
- Resolves: RHEL-245473 CVE-2026-76578 ipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI
- Resolves: RHEL-240909 CVE-2026-13097 ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore [rhel-10.2.z]
- Resolves: RHEL-240842 CVE-2026-11861 ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships [rhel-10.2.z]
- Resolves: RHEL-240821 CVE-2026-73197 ipa: FreeIPA: Unauthenticated DoS in /ipa/migration/migration.py via Unbounded Request Body Read [rhel-10.2.z]
- Resolves: RHEL-240800 CVE-2026-73198 ipa: FreeIPA: Unauthenticated DoS in /ipa/i18n_messages via Unbounded Request Body Read [rhel-10.2.z]
- Resolves: RHEL-240768 ipa-migrate tool is renaming host records & host info in automount information [rhel-10.2.z]
- Resolves: RHEL-238676 ipa-migrate: require Replication Administrator privilege [rhel-10.2.z]
- Resolves: RHEL-238673 ipa-epn: drop_privileges method is mixing uid and gid [rhel-10.2.z]
- Resolves: RHEL-238526 ipa env: support only simple * wildcard [rhel-10.2.z]
- Resolves: RHEL-238522 host-mod: handle the password attribute when set with --setattr userpassword= [rhel-10.2.z]
- Resolves: RHEL-238518 ipa-otptoken-import hardening [rhel-10.2.z]
- Resolves: RHEL-238516 Remove NetBIOS dependencies in Identity Manager [rhel-10.2.z]
- Resolves: RHEL-238510 WebUI Hardening [rhel-10.2.z]
- Resolves: RHEL-218853 CVE-2026-18147 ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL
- Resolves: RHEL-173375 [Cursor Automated] Include latest fixes in python3-ipatests package [RHEL10.2]

[4.13.1-3.2]
- Resolves: RHEL-168516 TestIPAMigrationProdMode tests are missing

[4.13.1-3.1]
- Resolves: RHEL-155027 Adding a group with 32Bit Idrange fails
- Resolves: RHEL-153145 IdM password policy Min lifetime is not enforced when high minlife is set
- Resolves: RHEL-166864 Include latest fixes in python3-ipatests package