[rpms/freeipa] f43: FreeIPA 4.13.3: security fixes release

[rpms/freeipa] f43: FreeIPA 4.13.3: security fixes release

[Alexander Bokovoy]

            A new commit has been pushed.

            Repo   : rpms/freeipa
            Branch : f43
            Commit : d001ddd800e7c0a35079af116fba0eef8c1cabaf
            Author : Alexander Bokovoy <abokovoy@redhat.com>
            Date   : 2026-08-21T11:07:18+03:00
            Stats  : +72/-8 in 4 file(s)
            URL    : https://src.fedoraproject.org/rpms/freeipa/c/d001ddd800e7c0a35079af116fba0eef8c1cabaf?branch=f43

            Log:
            FreeIPA 4.13.3: security fixes release

Resolves: CVE-2026-11861, CVE-2026-13097, CVE-2026-19550, CVE-2026-73199, CVE-2026-73198, CVE-2026-73197, CVE-2026-73196

Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>

---
diff --git a/.gitignore b/.gitignore
index 799dc8f..d88ca25 100644
--- a/.gitignore
+++ b/.gitignore
@@ -144,3 +144,5 @@
 /freeipa-4.13.1.tar.gz.asc
 /freeipa-4.13.2.tar.gz
 /freeipa-4.13.2.tar.gz.asc
+/freeipa-4.13.3.tar.gz
+/freeipa-4.13.3.tar.gz.asc

diff --git a/freeipa.spec b/freeipa.spec
index 9472d97..3d0ddce 100644
--- a/freeipa.spec
+++ b/freeipa.spec
@@ -196,8 +196,9 @@
 
 # Work-around fact that RPM SPEC parser does not accept
 # "Version: @VERSION@" in freeipa.spec.in used for Autoconf string replacement
-%define IPA_VERSION 4.13.2
-%global TARBALL_IPA_VERSION 4.13.2
+%define IPA_VERSION 4.13.3
+%global TARBALL_IPA_VERSION 4.13.3
+%global IPA_RELEASE_PATH %(echo $IPA_VERSION|tr . -)
 # Release candidate version -- uncomment with one percent for RC versions
 #%%global rc_version rc1
 %define AT_SIGN @
@@ -210,15 +211,15 @@
 
 Name:           %{package_name}
 Version:        %{IPA_VERSION}
-Release:        2%{?rc_version:.%rc_version}%{?dist}
+Release:        1%{?rc_version:.%rc_version}%{?dist}
 Summary:        The Identity, Policy and Audit system
 
 License:        GPL-3.0-or-later
 URL:            http://www.freeipa.org/
-Source0:        https://releases.pagure.org/freeipa/freeipa-%{TARBALL_IPA_VERSION}%{?rc_version}.tar.gz
+Source0:        https://codeberg.org/freeipa/freeipa/releases/download/release-%{IPA_RELEASE_PATH}/freeipa-%{TARBALL_IPA_VERSION}%{?rc_version}.tar.gz
 # Only use detached signature for the distribution builds. If it is a developer build, skip it
 %if %{NON_DEVELOPER_BUILD}
-Source1:        https://releases.pagure.org/freeipa/freeipa-%{TARBALL_IPA_VERSION}%{?rc_version}.tar.gz.asc
+Source1:        https://codeberg.org/freeipa/freeipa/releases/download/release-%{IPA_RELEASE_PATH}/freeipa-%{TARBALL_IPA_VERSION}%{?rc_version}.tar.gz.asc
 # https://www.freeipa.org/page/Verify_Release_Signature
 #
 # The following commands can be used to fetch the signing key via fingerprint
@@ -226,7 +227,10 @@ Source1:        https://releases.pagure.org/freeipa/freeipa-%{TARBALL_IPA_VERSIO
 #   fpr=0E63D716D76AC080A4A33513F40800B6298EB963
 #   gpg --keyserver keys.openpgp.org --receive-keys $fpr
 #   gpg --armor --export-options export-minimal --export $fpr >gpgkey-$fpr.asc
-Source2:        gpgkey-0E63D716D76AC080A4A33513F40800B6298EB963.asc
+# Source2:        gpgkey-0E63D716D76AC080A4A33513F40800B6298EB963.asc
+# Release 4.13.3 is signed by Rafael Jeffman
+# Rafael's key: 4B7E7AFBB0AAA98947CA2427F17E2569BEE3800C
+Source2:        gpgkey-4B7E7AFBB0AAA98947CA2427F17E2569BEE3800C.asc
 %endif
 
 # RHEL spec file only: START: Change branding to IPA and Identity Management
@@ -1197,6 +1201,7 @@ rm %{buildroot}/%{plugin_dir}/libipa_otp_counter.la
 rm %{buildroot}/%{plugin_dir}/libipa_otp_lasttoken.la
 rm %{buildroot}/%{plugin_dir}/libipa_graceperiod.la
 rm %{buildroot}/%{plugin_dir}/libtopology.la
+rm %{buildroot}/%{plugin_dir}/libipa_krbprinc_mr.la
 rm %{buildroot}/%{_libdir}/krb5/plugins/kdb/ipadb.la
 rm %{buildroot}/%{_libdir}/samba/pdb/ipasam.la
 
@@ -1644,6 +1649,7 @@ fi
 %attr(755,root,root) %{plugin_dir}/libipa_sidgen_task.so
 %attr(755,root,root) %{plugin_dir}/libipa_extdom_extop.so
 %attr(755,root,root) %{plugin_dir}/libipa_graceperiod.so
+%attr(755,root,root) %{plugin_dir}/libipa_krbprinc_mr.so
 %attr(755,root,root) %{_libdir}/krb5/plugins/kdb/ipadb.so
 %{_mandir}/man1/ipa-replica-conncheck.1*
 %{_mandir}/man1/ipa-replica-install.1*
@@ -1968,6 +1974,10 @@ fi
 %endif
 
 %changelog
+* Thu Aug 20 2026 Alexander Bokovoy <abokovoy@redhat.com> - 4.13.3-1
+- Upstream release 4.13.3
+- Resolves: CVE-2026-11861, CVE-2026-13097, CVE-2026-19550, CVE-2026-73199, CVE-2026-73198, CVE-2026-73197, CVE-2026-73196
+
 * Mon Aug 10 2026 Alexander Bokovoy <abokovoy@redhat.com> - 4.13.2-2
 - Rebuild against Samba 4.23.11
 

diff --git a/gpgkey-4B7E7AFBB0AAA98947CA2427F17E2569BEE3800C.asc b/gpgkey-4B7E7AFBB0AAA98947CA2427F17E2569BEE3800C.asc
new file mode 100644
index 0000000..4f58638
--- /dev/null
+++ b/gpgkey-4B7E7AFBB0AAA98947CA2427F17E2569BEE3800C.asc
@@ -0,0 +1,52 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBGp8Wo4BEACic1S8YhbO7m87MW1xOV5UfIVErrDUGY0YaEj95PWsmNPvyEPv
+YmGY/DKOyIrB4TRpstvFTIpkjxKLZXYrlo07nb8BzJZx7piP/yQ7EnY9ec2rTjSo
+Bf7SAt671xiAyhXv4ftwxC6IWRr1Bpj7na5LFI155esPLM6jRjfaQBy9Q1ov1NoC
+J6GHd5JLUjYSiwobB+J76lC+W4U1Gv/1tp/N/fYuk1Kpe/Z2mmavlMWxiECgbcal
++seDXK9IViyWW6KRLiTmzsOziaAAfwtPmYkBXbhdUolvZpGYHlrTzO9MyuZLA4eh
+Za2E3tzVXoX7u4GrNVrVhczMmYoYS0qOac2pv57MsNnsyKG1HdEt1NTPXARNZ2cW
+pft2L9rOmhw67R9ZHa4bBfoj5xRUSorTbIRY99CzNCnkHLb4gBDX9cok+HgiKBzX
+TgqsyCxOVzVuZigOVD+FqF8Ukng3cH2RZ1HOD8O3pLCHezIMp9Bc6KLDPJ7jnjxE
++O8V2leoFVG0i61PRn36iNZm2DRImGNzWkSyMcVdHc9apHv0lTOb9RHdEZk223y/
+6M6SuuKHiCC2Wwnnmk99cKt0kpp+VXxQUxnkGDxRUz3uJUaIQLIP3bgauTz8GGxo
+VEluzinLL8WnUUMC9+NtdH/56wIdVZUyP1ZVda2xteEeq7Y5fupCpbucwwARAQAB
+tC1SYWZhZWwgR3V0ZXJyZXMgSmVmZm1hbiA8cmplZmZtYW5AcmVkaGF0LmNvbT6J
+AlQEEwEIAD4WIQRLfnr7sKqpiUfKJCfxfiVpvuOADAUCanxajgIbAwUJCZQlpAUL
+CQgHAgYVCgkICwIEFgIDAQIeAQIXgAAKCRDxfiVpvuOADOtID/0YcK0jADxMpuAN
+awAQUp3ZwAy8ms5dCKhMk5CLAuC7NQXAQRWqjlv5M7DUq2r2OFmW2nNtBFj8+KHx
+m072r7RT8TOLxAhbV69qnp8AB/FUk8Seqccdepvle6ohhVhMudnVmrIz0y99a2LI
+C3V9GI/pAvuB/j5IKuUH53NYc5k92fEFGXZm9Nm3pAao6FY157dk3Dlx88KVKCJx
+dHbjkrfBbV5TL0u9zWltEMtv95VnTwiRHjkmfM9UCgciA2gkJmIF20dHRXqDFWwP
+N1Iz/HX74d2uZPhXJ79wVTwXMthh27/bQWOORJWoHsNLE0p2DxHLKSvGOKayJ++H
+iUkcavhYeD5xXI5nTffeS/JP5r8ERwKPuv+LhPeohiEChTl+nK2ar+zQ1Zr9UZW4
+V+9vEF9vdrHwpPVncCc8G7U/S/nu/1ccDYTxz2N0EHQsvMZ3OAlBrPt74gNyzZFq
+AcSQGMC3YHuuXI1RUAQdl1+VdJHryqEe6mh1+2Nh2JGtowFke6wxHT7ysXh1C6Ef
+wRP3l+2os0VIxLBhIcOejw6T25O/2WAGIptxFpbJt48bUzcFC0TR2q2AW95ikyEN
+jGmQAgOBdfodouH51g+d9bWQi5hCj/+pDE4z9bd9lW/HnXA6buoSRGDfeE+7O+KT
+KzMG+UZRMOdlU83nL4WCEhnhHGF6MLkCDQRqfFqOARAAurN0YWshPoIUYai5sQQa
+ejSL7l0emYMZTm4FXq1mNyvuWCYkGtLpJxQVCxWDC3Ezj5IVxtMA5YU8mP2eGSVO
+mfCmMlQuSVM/gu6YZ14NGLHpaazuTKngfrrZ5J3mSRr08uPVp9RYVM0diRUFI0Zw
+2ubLo/zjeMp+w1bd8qnA3Hl9nPMHki7aTHYmyxL/q6spIotttOVmoiTtfyN6b7tw
+L7dnQAPCRz9BCDx8vRggnakwEQvawEH8+dxWSd6fEP7ZdLgdOGkL6Q48RKHTBmIs
+3qS9AgWvMZjDg3TYAlFkWJDrLnG0DQcccHQpmaATo3/XnafuhLQoLOrR5vLcT0VZ
+9ouDU9+tMPq1IJOsGFywekYTLduu1w6C1ilzWOBTitM5fNwcE6ZhgmD54Fc4coSp
+AEGSTqyceG6zrtDe8JAPsimEx9kyY1aiyyi42ugfbpjzsmcvT+dvdeYShGJZoyRR
+AmvtVHH56jjt+oIr7rp9n/XC+u+u6eVZhmNZlW/JFAaEuhZt0m67Tuf99VwyurdA
+qcLxot1Q9bsd/a3bRvX3a45LaqjR3QSsO+5mwgYJJtWwLxLFHE6K2I9ZZr+e15W6
+N8eGh5TbuDrvlSoovC985NpDmOSHbySh8CkM15qHp9Ap7Qw8dYcD0LlyE6bFx090
+nqv1ly9AD3BQdHMXFPt7m0UAEQEAAYkCPAQYAQgAJhYhBEt+evuwqqmJR8okJ/F+
+JWm+44AMBQJqfFqOAhsMBQkJlCWkAAoJEPF+JWm+44AMRNkQAI/agDWvx78E/F0N
+DyhipgxCYR9y7JB/nOZeNK780KL9SSLlUlYHWkg9IF5MMtni8WQFuDx3rxXaV6mh
+5XXt0wzPe6WOMxk3Xbp+45iiMA2CvToEXTVAKbjfvPDgv419YP81H2tByWUsj3aE
+6yYvHUkt4p885m71ylDUlWYFPL1HtR+iWt4FikTY2cdyoXmxks4dXM6tF5hIe75a
+pHXE3QFFM0lOshPNewYoPMA9ETdFYpOpmS5JgEk7/yBlOor1ZyEtqR3ap972ZNuP
+GTk68WDdqeXTYvv6U6YQyStdy28mv2A44tdC0PVd+iXc4JrYMETEZi7wx2CeGB07
+xnMP5+QJ+/BKzT4qV0q2Urk+rDnEOJLdDpKQkMcgxCydeQ0BFNUAFVt2YcSsIajs
+SdIcV0303+kIqoFgY490mxcazyJA9H8fFDl+7FGJyemefbSlmTBZhqRDcy6Sl42F
+pKLvXeZ2S/4KIyNBPasLytxAfCvZ9cFjNNLQ4x/GnzLAt3xeVoIEFSGJwXAUXWbH
+SoTVDt49Tm4TmpPnpd76/TocyxXXnLJpcuWzFKhHWm51DVDBVc5lht4D1dW4Mto/
+UDoE7sJryoQ62rzDl3I5Jj3CwrAWb0/z5JJ1qxpJAkd/DX4Bkvx6thtMHG5kWj6M
+7mnjKzAoubqq/w+KOg8GJlinR3Mc
+=lYkw
+-----END PGP PUBLIC KEY BLOCK-----

diff --git a/sources b/sources
index 029125a..da806eb 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (freeipa-4.13.2.tar.gz) = 11fa7de4facbfe0b0fb278114d92a9d7b7750754d9194942e8967ecaf1fff3d5a61d5f409e4a50fbc3f65a14addb8eb865a16e7361632fcaf314464c5320ba73
-SHA512 (freeipa-4.13.2.tar.gz.asc) = 5ed637e30198ab527ff74f1f5940c5409bd6395a8b91668ed01221f49e61010c709206d74863dce40b60022bdb77bd608140d6cfda7ff5eee0662fca1a604964
+SHA512 (freeipa-4.13.3.tar.gz) = 9600639b14541df5a8fecce415068aba9b18a24e5e04080e352e253777fe02142e6eaa0c85fc76dbefdd270ad823074d043661ca86eddb34a3cd0fe3d84b8574
+SHA512 (freeipa-4.13.3.tar.gz.asc) = 74819d8e5fe1350d0a77d658d41eb5066551b28ac70c2e9b32a9c231f72e3002ba06a6ea9628fd796df1b4a4154f3dc82e8d5feabeded4722dc64b51becafbed