public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
From: Alexander Bokovoy <abokovoy@redhat.com>
To: git-commits@fedoraproject.org
Subject: [rpms/freeipa] f44: FreeIPA 4.13.3: security fixes release
Date: Thu, 20 Aug 2026 04:38:24 GMT [thread overview]
Message-ID: <178720070479.1.9196705106650401804.rpms-freeipa-f3908c01f19d@fedoraproject.org> (raw)
A new commit has been pushed.
Repo : rpms/freeipa
Branch : f44
Commit : f3908c01f19d27f25b2b1e979fe64da77a4e06c1
Author : Alexander Bokovoy <abokovoy@redhat.com>
Date : 2026-08-20T07:21:35+03:00
Stats : +75/-8 in 4 file(s)
URL : https://src.fedoraproject.org/rpms/freeipa/c/f3908c01f19d27f25b2b1e979fe64da77a4e06c1?branch=f44
Log:
FreeIPA 4.13.3: security fixes release
Resolves: CVE-2026-11861, CVE-2026-13097, CVE-2026-19550, CVE-2026-73199, CVE-2026-73198, CVE-2026-73197, CVE-2026-73196
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
---
diff --git a/.gitignore b/.gitignore
index 799dc8f..d88ca25 100644
--- a/.gitignore
+++ b/.gitignore
@@ -144,3 +144,5 @@
/freeipa-4.13.1.tar.gz.asc
/freeipa-4.13.2.tar.gz
/freeipa-4.13.2.tar.gz.asc
+/freeipa-4.13.3.tar.gz
+/freeipa-4.13.3.tar.gz.asc
diff --git a/freeipa.spec b/freeipa.spec
index d6e7dbf..63d2780 100644
--- a/freeipa.spec
+++ b/freeipa.spec
@@ -196,8 +196,9 @@
# Work-around fact that RPM SPEC parser does not accept
# "Version: @VERSION@" in freeipa.spec.in used for Autoconf string replacement
-%define IPA_VERSION 4.13.2
-%global TARBALL_IPA_VERSION 4.13.2
+%define IPA_VERSION 4.13.3
+%global TARBALL_IPA_VERSION 4.13.3
+%global IPA_RELEASE_PATH %(echo $IPA_VERSION|tr . -)
# Release candidate version -- uncomment with one percent for RC versions
#%%global rc_version rc1
%define AT_SIGN @
@@ -210,15 +211,15 @@
Name: %{package_name}
Version: %{IPA_VERSION}
-Release: 2%{?rc_version:.%rc_version}%{?dist}
+Release: 1%{?rc_version:.%rc_version}%{?dist}
Summary: The Identity, Policy and Audit system
License: GPL-3.0-or-later
URL: http://www.freeipa.org/
-Source0: https://releases.pagure.org/freeipa/freeipa-%{TARBALL_IPA_VERSION}%{?rc_version}.tar.gz
+Source0: https://codeberg.org/freeipa/freeipa/releases/download/release-%{IPA_RELEASE_PATH}/freeipa-%{TARBALL_IPA_VERSION}%{?rc_version}.tar.gz
# Only use detached signature for the distribution builds. If it is a developer build, skip it
%if %{NON_DEVELOPER_BUILD}
-Source1: https://releases.pagure.org/freeipa/freeipa-%{TARBALL_IPA_VERSION}%{?rc_version}.tar.gz.asc
+Source1: https://codeberg.org/freeipa/freeipa/releases/download/release-%{IPA_RELEASE_PATH}/freeipa-%{TARBALL_IPA_VERSION}%{?rc_version}.tar.gz.asc
# https://www.freeipa.org/page/Verify_Release_Signature
#
# The following commands can be used to fetch the signing key via fingerprint
@@ -226,7 +227,10 @@ Source1: https://releases.pagure.org/freeipa/freeipa-%{TARBALL_IPA_VERSIO
# fpr=0E63D716D76AC080A4A33513F40800B6298EB963
# gpg --keyserver keys.openpgp.org --receive-keys $fpr
# gpg --armor --export-options export-minimal --export $fpr >gpgkey-$fpr.asc
-Source2: gpgkey-0E63D716D76AC080A4A33513F40800B6298EB963.asc
+# Source2: gpgkey-0E63D716D76AC080A4A33513F40800B6298EB963.asc
+# Release 4.13.3 is signed by Rafael Jeffman
+# Rafael's key: 4B7E7AFBB0AAA98947CA2427F17E2569BEE3800C
+Source2: gpgkey-4B7E7AFBB0AAA98947CA2427F17E2569BEE3800C.asc
%endif
# RHEL spec file only: START: Change branding to IPA and Identity Management
@@ -1197,6 +1201,7 @@ rm %{buildroot}/%{plugin_dir}/libipa_otp_counter.la
rm %{buildroot}/%{plugin_dir}/libipa_otp_lasttoken.la
rm %{buildroot}/%{plugin_dir}/libipa_graceperiod.la
rm %{buildroot}/%{plugin_dir}/libtopology.la
+rm %{buildroot}/%{plugin_dir}/libipa_krbprinc_mr.la
rm %{buildroot}/%{_libdir}/krb5/plugins/kdb/ipadb.la
rm %{buildroot}/%{_libdir}/samba/pdb/ipasam.la
@@ -1644,6 +1649,7 @@ fi
%attr(755,root,root) %{plugin_dir}/libipa_sidgen_task.so
%attr(755,root,root) %{plugin_dir}/libipa_extdom_extop.so
%attr(755,root,root) %{plugin_dir}/libipa_graceperiod.so
+%attr(755,root,root) %{plugin_dir}/libipa_krbprinc_mr.so
%attr(755,root,root) %{_libdir}/krb5/plugins/kdb/ipadb.so
%{_mandir}/man1/ipa-replica-conncheck.1*
%{_mandir}/man1/ipa-replica-install.1*
@@ -1968,9 +1974,16 @@ fi
%endif
%changelog
+* Thu Aug 20 2026 Alexander Bokovoy <abokovoy@redhat.com> - 4.13.3-1
+- Upstream release 4.13.3
+- Resolves: CVE-2026-11861, CVE-2026-13097, CVE-2026-19550, CVE-2026-73199, CVE-2026-73198, CVE-2026-73197, CVE-2026-73196
+
* Wed Aug 19 2026 Adam Williamson <awilliam@redhat.com> - 4.13.2-2
- Rebuild without changes to keep version ahead of F43
+* Fri Aug 14 2026 Alexander Bokovoy <abokovoy@redhat.com> - 4.13.2-2
+- Rebuilt for Samba-4.25.0-RC1
+
* Mon Aug 3 2026 Alexander Bokovoy <abokovoy@redhat.com> - 4.13.2-1
- FreeIPA 4.13.2
diff --git a/gpgkey-4B7E7AFBB0AAA98947CA2427F17E2569BEE3800C.asc b/gpgkey-4B7E7AFBB0AAA98947CA2427F17E2569BEE3800C.asc
new file mode 100644
index 0000000..4f58638
--- /dev/null
+++ b/gpgkey-4B7E7AFBB0AAA98947CA2427F17E2569BEE3800C.asc
@@ -0,0 +1,52 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBGp8Wo4BEACic1S8YhbO7m87MW1xOV5UfIVErrDUGY0YaEj95PWsmNPvyEPv
+YmGY/DKOyIrB4TRpstvFTIpkjxKLZXYrlo07nb8BzJZx7piP/yQ7EnY9ec2rTjSo
+Bf7SAt671xiAyhXv4ftwxC6IWRr1Bpj7na5LFI155esPLM6jRjfaQBy9Q1ov1NoC
+J6GHd5JLUjYSiwobB+J76lC+W4U1Gv/1tp/N/fYuk1Kpe/Z2mmavlMWxiECgbcal
++seDXK9IViyWW6KRLiTmzsOziaAAfwtPmYkBXbhdUolvZpGYHlrTzO9MyuZLA4eh
+Za2E3tzVXoX7u4GrNVrVhczMmYoYS0qOac2pv57MsNnsyKG1HdEt1NTPXARNZ2cW
+pft2L9rOmhw67R9ZHa4bBfoj5xRUSorTbIRY99CzNCnkHLb4gBDX9cok+HgiKBzX
+TgqsyCxOVzVuZigOVD+FqF8Ukng3cH2RZ1HOD8O3pLCHezIMp9Bc6KLDPJ7jnjxE
++O8V2leoFVG0i61PRn36iNZm2DRImGNzWkSyMcVdHc9apHv0lTOb9RHdEZk223y/
+6M6SuuKHiCC2Wwnnmk99cKt0kpp+VXxQUxnkGDxRUz3uJUaIQLIP3bgauTz8GGxo
+VEluzinLL8WnUUMC9+NtdH/56wIdVZUyP1ZVda2xteEeq7Y5fupCpbucwwARAQAB
+tC1SYWZhZWwgR3V0ZXJyZXMgSmVmZm1hbiA8cmplZmZtYW5AcmVkaGF0LmNvbT6J
+AlQEEwEIAD4WIQRLfnr7sKqpiUfKJCfxfiVpvuOADAUCanxajgIbAwUJCZQlpAUL
+CQgHAgYVCgkICwIEFgIDAQIeAQIXgAAKCRDxfiVpvuOADOtID/0YcK0jADxMpuAN
+awAQUp3ZwAy8ms5dCKhMk5CLAuC7NQXAQRWqjlv5M7DUq2r2OFmW2nNtBFj8+KHx
+m072r7RT8TOLxAhbV69qnp8AB/FUk8Seqccdepvle6ohhVhMudnVmrIz0y99a2LI
+C3V9GI/pAvuB/j5IKuUH53NYc5k92fEFGXZm9Nm3pAao6FY157dk3Dlx88KVKCJx
+dHbjkrfBbV5TL0u9zWltEMtv95VnTwiRHjkmfM9UCgciA2gkJmIF20dHRXqDFWwP
+N1Iz/HX74d2uZPhXJ79wVTwXMthh27/bQWOORJWoHsNLE0p2DxHLKSvGOKayJ++H
+iUkcavhYeD5xXI5nTffeS/JP5r8ERwKPuv+LhPeohiEChTl+nK2ar+zQ1Zr9UZW4
+V+9vEF9vdrHwpPVncCc8G7U/S/nu/1ccDYTxz2N0EHQsvMZ3OAlBrPt74gNyzZFq
+AcSQGMC3YHuuXI1RUAQdl1+VdJHryqEe6mh1+2Nh2JGtowFke6wxHT7ysXh1C6Ef
+wRP3l+2os0VIxLBhIcOejw6T25O/2WAGIptxFpbJt48bUzcFC0TR2q2AW95ikyEN
+jGmQAgOBdfodouH51g+d9bWQi5hCj/+pDE4z9bd9lW/HnXA6buoSRGDfeE+7O+KT
+KzMG+UZRMOdlU83nL4WCEhnhHGF6MLkCDQRqfFqOARAAurN0YWshPoIUYai5sQQa
+ejSL7l0emYMZTm4FXq1mNyvuWCYkGtLpJxQVCxWDC3Ezj5IVxtMA5YU8mP2eGSVO
+mfCmMlQuSVM/gu6YZ14NGLHpaazuTKngfrrZ5J3mSRr08uPVp9RYVM0diRUFI0Zw
+2ubLo/zjeMp+w1bd8qnA3Hl9nPMHki7aTHYmyxL/q6spIotttOVmoiTtfyN6b7tw
+L7dnQAPCRz9BCDx8vRggnakwEQvawEH8+dxWSd6fEP7ZdLgdOGkL6Q48RKHTBmIs
+3qS9AgWvMZjDg3TYAlFkWJDrLnG0DQcccHQpmaATo3/XnafuhLQoLOrR5vLcT0VZ
+9ouDU9+tMPq1IJOsGFywekYTLduu1w6C1ilzWOBTitM5fNwcE6ZhgmD54Fc4coSp
+AEGSTqyceG6zrtDe8JAPsimEx9kyY1aiyyi42ugfbpjzsmcvT+dvdeYShGJZoyRR
+AmvtVHH56jjt+oIr7rp9n/XC+u+u6eVZhmNZlW/JFAaEuhZt0m67Tuf99VwyurdA
+qcLxot1Q9bsd/a3bRvX3a45LaqjR3QSsO+5mwgYJJtWwLxLFHE6K2I9ZZr+e15W6
+N8eGh5TbuDrvlSoovC985NpDmOSHbySh8CkM15qHp9Ap7Qw8dYcD0LlyE6bFx090
+nqv1ly9AD3BQdHMXFPt7m0UAEQEAAYkCPAQYAQgAJhYhBEt+evuwqqmJR8okJ/F+
+JWm+44AMBQJqfFqOAhsMBQkJlCWkAAoJEPF+JWm+44AMRNkQAI/agDWvx78E/F0N
+DyhipgxCYR9y7JB/nOZeNK780KL9SSLlUlYHWkg9IF5MMtni8WQFuDx3rxXaV6mh
+5XXt0wzPe6WOMxk3Xbp+45iiMA2CvToEXTVAKbjfvPDgv419YP81H2tByWUsj3aE
+6yYvHUkt4p885m71ylDUlWYFPL1HtR+iWt4FikTY2cdyoXmxks4dXM6tF5hIe75a
+pHXE3QFFM0lOshPNewYoPMA9ETdFYpOpmS5JgEk7/yBlOor1ZyEtqR3ap972ZNuP
+GTk68WDdqeXTYvv6U6YQyStdy28mv2A44tdC0PVd+iXc4JrYMETEZi7wx2CeGB07
+xnMP5+QJ+/BKzT4qV0q2Urk+rDnEOJLdDpKQkMcgxCydeQ0BFNUAFVt2YcSsIajs
+SdIcV0303+kIqoFgY490mxcazyJA9H8fFDl+7FGJyemefbSlmTBZhqRDcy6Sl42F
+pKLvXeZ2S/4KIyNBPasLytxAfCvZ9cFjNNLQ4x/GnzLAt3xeVoIEFSGJwXAUXWbH
+SoTVDt49Tm4TmpPnpd76/TocyxXXnLJpcuWzFKhHWm51DVDBVc5lht4D1dW4Mto/
+UDoE7sJryoQ62rzDl3I5Jj3CwrAWb0/z5JJ1qxpJAkd/DX4Bkvx6thtMHG5kWj6M
+7mnjKzAoubqq/w+KOg8GJlinR3Mc
+=lYkw
+-----END PGP PUBLIC KEY BLOCK-----
diff --git a/sources b/sources
index 029125a..da806eb 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (freeipa-4.13.2.tar.gz) = 11fa7de4facbfe0b0fb278114d92a9d7b7750754d9194942e8967ecaf1fff3d5a61d5f409e4a50fbc3f65a14addb8eb865a16e7361632fcaf314464c5320ba73
-SHA512 (freeipa-4.13.2.tar.gz.asc) = 5ed637e30198ab527ff74f1f5940c5409bd6395a8b91668ed01221f49e61010c709206d74863dce40b60022bdb77bd608140d6cfda7ff5eee0662fca1a604964
+SHA512 (freeipa-4.13.3.tar.gz) = 9600639b14541df5a8fecce415068aba9b18a24e5e04080e352e253777fe02142e6eaa0c85fc76dbefdd270ad823074d043661ca86eddb34a3cd0fe3d84b8574
+SHA512 (freeipa-4.13.3.tar.gz.asc) = 74819d8e5fe1350d0a77d658d41eb5066551b28ac70c2e9b32a9c231f72e3002ba06a6ea9628fd796df1b4a4154f3dc82e8d5feabeded4722dc64b51becafbed
reply other threads:[~2026-08-20 4:38 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=178720070479.1.9196705106650401804.rpms-freeipa-f3908c01f19d@fedoraproject.org \
--to=abokovoy@redhat.com \
--cc=git-commits@fedoraproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox