FreeIPA 4.13.4 ============== .. raw:: mediawiki {{ReleaseDate|2026-07-09}} The FreeIPA team would like to announce FreeIPA 4.13.4 release! It can be downloaded from http://www.freeipa.org/page/Downloads. Builds for Fedora distributions will be available from the official repository soon. .. _highlights_in_4.13.4: Highlights in 4.13.4 -------------------- .. _security_issues: Security issues ~~~~~~~~~~~~~~~ CVE-2026-79678: idp-add eval() reachable before authorization check allows environment disclosure and denial of service ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ A flaw was found in FreeIPA's idp-add command. `ipapython.ipautil.template_str()` evaluates any `eval(...)` token found in a post-substitution string using Python's `eval()`. `ipaserver/plugins/idp.py` passes the caller-supplied `--organization` and `--base-url` values (`ipaidporg`/`ipaidpbaseurl`), which have no input validation, into this function via provider templates (okta, keycloak, microsoft). The LDAPCreate command framework runs this evaluation inside `pre_callback`, before the LDAP access control check that restricts idp-add to the 'External IdP server Administrators' privilege is ever evaluated. As a result, any authenticated IPA principal, regardless of privilege level, can trigger this evaluation. Callbacks such as `pre_callback` run by the IPA API LDAP framework automatically. The fix is to apply permissions and ACIs checks to the authenticated IPA principal before any callbacks are executed. This report prompted us to look at the overall access control checks in IPA API LDAP framework use. To fix similar issues in the framework overall, on top of LDAP access controls, we added an access control check to all IPA API operations. These checks take both ACL sources into account: - managed permissions defined in IPA plugins - implicit LDAP ACIs defined in LDAP Managed permissions are associated with each LDAP object in IPA API and represent IPA API permissions and the privileges they can bear. Privileges associated with managed permissions are visible to administrators and membership can be added to grant permissions to administrators. The privileges converted into LDAP ACIs at runtime and updated every time new FreeIPA code is deployed. CVE-2026-76578: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Due to a bug in 389-ds directory server's implementation of access controls, an unauthenticated LDAP client (anonymous bind or SASL ANONYMOUS) can create a self-managed OTP token entry with empty ipaTokenOwner/managedBy attributes, which satisfy 389 Directory Server's SELFDN ACI evaluator against the anonymous bind's own empty DN (see companion 389-ds flaw for that underlying defect). FreeIPA's self-managed-token ACI (install/share/default-aci.ldif) does not restrict which other attributes may be added, allowing the client to inject an arbitrary attacker-chosen Kerberos principal that does not yet exist in the LDAP database. Mitigations introduced for CVE-2026-13097 fix does not allow overtaking existing accounts. The attack may be used as a stepping stone to take over administrative privileges. Additional access controls hardening was applied to prevent follow up activities to elevate state of acquired credentials to administrative ones. In order to address this vulnerability, FreeIPA and 389-ds teams had to review existing access controls implementation in both projects. On FreeIPA side the team chose to tighten up permissions guarding self-management access: the bare `userdn = "ldap:///self"` bind rule was replaced with `(userdn = "ldap:///self" and userdn = "ldap:///all")` bind rule. The latter ensures that any user DN in an active LDAP bind matching the `ldap:///self` is also an authenticated one (e.g. `ldap:///all`). In anonymous LDAP binds the userdn is an empty string that cannot match `ldap:///all` -------------- .. _bug_fixes: Bug fixes ~~~~~~~~~ FreeIPA 4.13.4 is a stabilization release for the features delivered as a part of 4.13 version series. There are multiple bug-fixes since FreeIPA 4.13.3 release. Details of the bug-fixes can be seen in the list of resolved tickets below. Upgrading --------- Upgrade instructions are available on `Upgrade `__ page. Feedback -------- Please provide comments, bugs and other feedback via the freeipa-users mailing list (https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahosted.org/) or #freeipa channel on libera.chat. .. _resolved_tickets: Resolved tickets ---------------- - `#9968 `__ - `#7415 `__ - `#10036 `__ - `#10029 `__ .. _detailed_changelog_since_4.13.3: Detailed changelog since 4.13.3 ------------------------------- .. _alexander_bokovoy_35: Alexander Bokovoy (35) ~~~~~~~~~~~~~~~~~~~~~~ - vault: fix linting issues `commit `__ - vault: document why vaultconfig_show is intentionally ungated `commit `__ - cert: authorize certificate retrieval before reaching the RA agent `commit `__ - ca, certprofile: require CA Administrator before RA-agent changes `commit `__ - certmap: require privilege before matching certificates via SSSD `commit `__ - trust: require Replication Administrators before refreshing trust topology `commit `__ - baseldap: fall back to effective rights when enforcing managed permissions `commit `__ - admins: grant admins group all default privileges `commit `__ - trust_add: require Replication Administrators privilege `commit `__ - baseldap: force permission checks in LDAP-oriented operations `commit `__ - tests: xmlrpc: cover the permission authentication checks `commit `__ - tests: xmlrpc: expect the hardened self-service ACIs `commit `__ - tests: ipalib: cover parsing of absolute denies and compound bind rules `commit `__ - aci: regenerate ACI.txt for the permission changes `commit `__ - install: register the new 21-* ACI update scripts `commit `__ - aci: convert the self-service ACIs to the hardened bind rule on upgrade `commit `__ - aci: use the hardened self-service bind rule in the upgrade ACIs `commit `__ - aci: deny anonymous SID reads in the upgrade update `commit `__ - aci: deny all anonymous modifications in the upgrade update `commit `__ - aci: key the anonymous denies on the empty DN; harden the self-service rules `commit `__ - aci: generate the hardened self-service bind rule `commit `__ - aci: parse absolute denies and compound bind rules `commit `__ - otp: constrain the self-managed-token ADD to OTP object classes `commit `__ - trusts: scope Samba ipaNTHash ACI to cn=accounts `commit `__ - host: exclude ipaservers from delegated host-write permissions `commit `__ - group: read the SID only when authenticated; exclude protected groups from delegated writes `commit `__ - stageuser: exclude privileged accounts from delegated credential writes `commit `__ - user: read the SID only when authenticated; exclude privileged accounts from delegated writes `commit `__ - permission: require an authenticated bind for modification permissions `commit `__ - ipa-pwd-extop: fail closed if password metadata cannot be written `commit `__ - certprofile: reject import of profiles that can execute programs `commit `__ - kdb: enforce CNAME comparison against ipaOriginalUid in ID overrides `commit `__ `#10041 `__ - Principal: implicitly convert to Principal for comparison `commit `__ - ipatests: Fix expectations in test_i18n_messages_valid `commit `__ - doc: update API change for principal from Str to Principal `commit `__ .. _david_hanina_1: David Hanina (1) ~~~~~~~~~~~~~~~~ - Spec file: bump samba version to 4.23.11 for Fedora < 44 `commit `__ .. _erik_belko_1: Erik Belko (1) ~~~~~~~~~~~~~~ - ipatests: Add ipa-getcert start-tracking tests `commit `__ `#9968 `__ .. _rafael_guterres_jeffman_1: Rafael Guterres Jeffman (1) ~~~~~~~~~~~~~~~~~~~~~~~~~~~ - Back to git snapshots `commit `__ .. _stanislav_levin_1: Stanislav Levin (1) ~~~~~~~~~~~~~~~~~~~ - installer: check all the required PKI ports `commit `__ `#7415 `__ `#10036 `__ .. _sudhir_menon_1: Sudhir Menon (1) ~~~~~~~~~~~~~~~~ - ipatests: Fixes for ds-migration testsuite. `commit `__ `#10029 `__