# changelog

author: Mark Reynolds <mreynolds@redhat.com> - 2.0.14-2
changelog:
  - Bump version to 2.0.14-2
  - Resolves: Bug 2027783 - CVE-2021-4091 389-ds-base: double-free of the virtual attribute context in persistent search
  - Issue 4299 - UI - fix minor issues with ldap editor (table view)
  - Issue 4299 - UI - fix minor issues with ldap editor
  - Issue 5103 - UI - Add support for TPR to web console (#5111)
  - Bump version to 2.0.14-1
  - Issue 5127 - ds_selinux_restorecon.sh: always exit 0
  - Issue 5037 - in OpenQA changelog trimming can crashes (#5070)
  - Issue 4992 - BUG - slapd.socket container fix (#4993)
  - Issue 5079 - BUG - multiple ways to specific primary (#5087)
  - Issue 5080 - BUG - multiple index types not handled in openldap migration (#5094)
  - Issue 5135 - UI - Disk monitoring threshold does update properly
  - Issue 5129 - BUG - Incorrect fn signature in add_index (#5130)
  - Bump version to 2.0.13
  - Issue 5132 - Update Rust crate lru to fix CVE
  - Issue 3555 - UI - fix audit issue with npm nanoid
  - Issue 4299 - UI - Add ACI editing features
  - Issue 4299 - UI LDAP editor - add "edit" and "rename" functionality
  - Issue 5127 - run restorecon on /dev/shm at server startup
  - Issue 5124 - dscontainer fails to create an instance
  - Issue 4312 - fix compiler warning
  - Issue 5115 - AttributeError: type object 'build_manpages' has no attribute 'build_manpages'
  - Issue 4312 - performance search rate: contention on global monitoring counters (#4940)
  - Issue 5105 - During a bind, if the target entry is not reachable the operation may complete without sending result (#5107)
  - Issue 5095 - sync-repl with openldap may send truncated syncUUID (#5099)
  - Issue 3584 - Add is_fips check to password tests (#5100)
  - Issue 5074 - retro changelog cli updates (#5075)
  - Issue 4994 - Revert retrocl dependency workaround (#4995)


author: Mark Reynolds <mreynolds@redhat.com> - 2.0.14-3
changelog:
  - Bump version to 2.0.14-3
  - Resolves: Bug 2017411 - cockpit crashes because invalid SASL mapping regex was saved


author: Mark Reynolds <mreynolds@redhat.com> - 2.0.14-4
changelog:
  - Bump version to 2.0.14-4
  - Resolves: Bug 2047191 - plugin entryuuid failing
  - Resolves: Bug 2057059 - Import may break replication because changelog starting csn may not be created
  - Resovles: Bug 2017411 - cockpit crashes because invalid SASL mapping regex was saved


author: Mark Reynolds <mreynolds@redhat.com> - 2.0.14-5
changelog:
  - Bump version to 2.0.14-5
  - Resolves: CVE-2022-0918 389-ds-base: sending crafted message could result in DoS 
  - Issue 5234 - UI - rename Users and Groups tab


author: Mark Reynolds <mreynolds@redhat.com> - 2.0.14-6
changelog:
  - Bump version to 2.0.14-6
  - Resolves: CVE-2022-0918 389-ds-base: sending crafted message could result in DoS(revised)


author: Mark Reynolds <mreynolds@redhat.com> - 2.0.14-7
changelog:
  - Bump version to 2.0.14-7
  - Resolves: Bug 2057056 - Import may break the replication because changelog starting csn may not be created


author: Mark Reynolds <mreynolds@redhat.com> - 2.1.1-1
changelog:
  - Bump version to 2.1.1-1
  - Issue 5230 - Race condition in RHDS disk monitoring functions
  - Issue 4299 - UI - Add CoS funtionality (#5196)
  - Issue 5225 - UI - impossible to manually set entry cache
  - Issue 5186 - UI - Fix SASL Mapping regex test feature
  - Issue 5221 - User with expired password can still login with full privledges
  - Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  - Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)
  - Issue 5200 - dscontainer should use environment variables with DS_ prefix
  - Issue 5189 - memberOf plugin exclude subtree not cleaning up groups on modrdn
  - Issue 5051 - RFE - ADSync flatten tree (#5192)
  - Issue 5188 - UI - LDAP editor - add entry and group types
  - Issue 5184 - memberOf does not work correctly with multiple include scopes
  - Issue 5162 - BUG - error on importing chain files (#5164)
  - Issue 5186 - UI - Fix SASL Mapping regex validation and other minor improvements
  - Issue 5048 - Support for nsslapd-tcp-fin-timeout and nsslapd-tcp-keepalive-time (#5179)
  - Issue 5122 - dsconf instance backend suffix set doesn't accept backend name (#5178)
  - Issue 5032 - Fix configure option in specfile (#5174)
  - Issue 5176 - CI rewriter fails when libslapd.so.0 does not exist (#5177)
  - Issue 5160 - BUG - x- prefix in descr-oid can confuse oid parser (#5161)
  - Issue 5137 - RFE - improve sssd conf output (#5138)
  - Issue 5102 - BUG - container may fail with bare uid/gid (#5140)
  - Issue 5145 - Fix covscan errors
  - Issue 4721 - UI - attribute uniqueness crashes UI when there are no configs
  - Issue 5155 - RFE - Provide an option to abort an Auto Member rebuild task
  - Issue 4299 - UI - Add Role funtionality (#5163)
  - Issue 5050 - bdb bulk op fails if fs page size > 8K (#5150)
  - Issue 5149 - Build failure on EL8 - undefined reference to `twalk_r'


author: Mark Reynolds <mreynolds@redhat.com> - 2.1.4-1
changelog:
  - Bump version to 2.1.4-1
  - Resolves: Bug 1893667 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  - Resolves: Bug 1934067 - dbscan crash due to a segmentation fault when looking up for key "=ffffffff-ffffffff-ffffffff-ffffffff"
  - Resolves: Bug 2029839 - Unable to Switch the "Dictionary Check" option from RHDS11 Cockpit to ON/OFF
  - Resolves: Bug 2057066 - dscreate - add options for setting up replication
  - Resolves: Bug 2066941 - RHDS UI - No way to move back to Get Started step while adding a New Entry
  - Resolves: Bug 2069842 - RHDS UI - Add account locking missing functionality
  - Resolves: Bug 2090069 - Stopping an instance does not return to the "This server instance is not running, either start it from the Actions dropdown menu, or choose a different instance" screen.
  - Resolves: Bug 2090140 - Selecting and deselecting "Reindex Attribute After Saving" while edit Database index doesn't disable Save button
  - Resolves: Bug 2090152 - While selecting multiple attributes for encryption, it only shows one as selected but all the other attributes get added.
  - Resolves: Bug 2090393 - Add a warning when port numbers are set to zero.
  - Resolves: Bug 2090403 - Reduce the number of messages produced by the Monitoring tab in the JS Console.
  - Resolves: Bug 2090449 - No numeric log level details provided under cockpit
  - Resolves: Bug 2090460 - can not perform modrdn on naming attribute set by cockpit
  - Resolves: Bug 2090499 - Selecting an Index Type before selecting an Attribute causes the Create Index button to remain greyed out
  - Resolves: Bug 2090687 - [RFE] Put search box while editing attributes for the LDAP user or group just objectClass
  - Resolves: Bug 2095765 - Failure to enable/disable logs.


author: Mark Reynolds <mreynolds@redhat.com> - 2.1.5-1
changelog:
  - Bump version to 2.1.5-1
  - Resolves: Bug 2119110 - CVE-2022-2850 redhat-ds:12/389-ds-base: SIGSEGV in sync_repl


author: Mark Reynolds <mreynolds@redhat.com> - 2.1.8-1
changelog:
  - Bump version to 2.1.8-1
  - Rebase to 389-ds-nase-2.1.8
  - Resolves: Bug 2177930 - RHDS: LDAP browser tries to decode userPassword instead of userCertificate attribute


author: Mark Reynolds <mreynolds@redhat.com> - 2.2.6-1
changelog:
  - Bump version to 2.2.6-1
  - rebase RHDS 12.2 to 389-ds-base-2.2.6
  - resolves: rhbz#1878808 - [RFE] dsconf instance security ca-certificate add: Cannot load a certificate bundle
  - resolves: rhbz#1924569 - dscreate error, cannot start ns-slapd with custom db_dir path, incorrect sub dir permissions
  - resolves: rhbz#1956987 - RHDS Replication fails after changing password of Replication Manager
  - resolves: rhbz#2057070 - Improve password policy debug logging
  - resolves: rhbz#2075017 - RFE - performance improvement - store full entry DN in database record
  - resolves: rhbz#2142639 - pam mutex lock causing high etimes, affecting red hat internal sso
  - resolves: rhbz#2143332 - Status of member of fixup task shows an invalid startup date
  - resolves: rhbz#2147388 - CLI and UI should reject trying to index a virtual attribute
  - resolves: rhbz#2158691 - NameError: name 'args_instance' is not defined in replica.py line 2708, in generate_report
  - resolves: rhbz#2017411 - cockpit crashes because invalid SASL mapping regex was saved


author: Mark Reynolds <mreynolds@redhat.com> - 2.2.7-1
changelog:
  - Bump version to 2.2.7-1
  - rebase RHDS 12.2 to 389-ds-base-2.2.7
  - resolves: rhbz#2177929 - RHDS: LDAP browser tries to decode userPassword instead of userCertificate attribute


author: Mark Reynolds <mreynolds@redhat.com> - 2.2.7-2
changelog:
  - Bump RHDS version to 2.2.7-2
  - resolves: rhbz#2174420 - RHDS Console 12.2. Database tab: Not functioning + button on Database Look Through Limit configuration, typo in word Through
  - resolves: rhbz#2174421 - RHDS Console 12.2. Server tab: In Log Settings the Save Setting button is not deactivating after changing number values to it's original value, allowing to post empty updates.


author: Mark Reynolds <mreynolds@redhat.com> - 2.2.7-3
changelog:
  - Bump RHDS version to 2.2.7-3
  - resolves: rhbz#1878808 - [RFE] dsconf instance security ca-certificate add: Cannot load a certificate bundle


author: Mark Reynolds <mreynolds@redhat.com> - 2.2.7-4
changelog:
  - Bump RHDS version to 2.2.7-4
  - resolves: rhbz#2209983 - Message about missing dscr file in Monitoring tab


author: Thierry Bordaz <tbordaz@redhat.com> - 2.2.7-5
changelog:
  - Bump RHDS version to 2.2.7-5
  - resolves: rhbz#2186260 - Disabling replication on Consumer crashes server
  - resolves: rhbz#2246367 - bdb_start - Detected Disorderly Shutdown directory server is not starting
  - resolves: rhbz#2251375 - dtablesize being set to soft maxfiledescriptor limit causing massive slowdown in large enviroments
  - resolves: rhbz#2256585 - After an upgrade the LDAP server won't start if nsslapd-conntablesize is present in the dse.ldif file
  - resolves: rhbz#2251374 - Paged search impacts performance
  - resolves: rhbz#2251032 - Crash on open/close connections
  - resolves: rhbz#2256594 - ns-slapd crash in slapi_attr_basetype


author: Mark Reynolds <mreynolds@redhat.com> - 2.2.4-3
changelog:
  - Bump version to 2.2.4-3
  - Resolves: rhbz#2142636 - pam mutex lock causing high etimes, affecting red hat internal sso
  - Resolves: rhbz#2093981 - RFE - Create Security Audit Log
  - Resolves: rhbz#2132697 - [RFE] 389ds: run as non-root
  - Resolves: rhbz#2124660 - Retro changelog trimming uses maxage incorrectly
  - Resolves: rhbz#2114039 - Current pbkdf2 hardcoded parameters are no longer secure
  - Resolves: rhbz#2112998 - performance search rate: checking if an entry is a referral is expensive
  - Resolves: rhbz#2112361 - Supplier should do periodic update to avoid slow replication when a new direct update happen
  - Resolves: rhbz#2109891 - Migrate 389 to pcre2


author: Mark Reynolds <mreynolds@redhat.com> - 2.3.4-3
changelog:
  - Bump version to 2.3.4-3
  - Resolves: rhbz#2189954 - RFE Improve reponse time to filters containing 'nsrole'
  - Resolves: rhbz#2189946 - RFE support of slapi_memberof for plugins/core server
  - Resolves: rhbz#1974242 - Paged search impacts performance


author: Mark Reynolds <mreynolds@redhat.com> - 2.3.6-2
changelog:
  - Bump version to 2.3.6-2
  - Resolves: rhbz#2225532 - 389-ds-base FTBFS with rust-1.71.0
  - Resolves: rhbz#2218209 - useradd: invalid user ID '389:389': installing 389-ds-base in container fails to create the dirsrv user
  - Resolves: rhbz#2207691 - python3-lib389: Python tarfile extraction needs change to avoid a warning
  - Resolves: rhbz#2179278 - dirsrv failed to start after reboot because "dirsrv" did not have access on /run/dirsrv


author: Simon Pichugin <spichugi@redhat.com> - 2.3.6-3
changelog:
  - Bump version to 2.3.6-3
  - Resolves: rhbz#2236163 - Regression: replication can't be enabled for consumer or hub role


author: Viktor Ashirov <vashirov@redhat.com> - 2.3.6-5
changelog:
  - Bump version to 2.3.6-5
  - Resolves: rhbz#2240021 - An upgrade of cockpit-389-ds should update other 389-ds packages.


author: Thierry Bordaz <tbordaz@redhat.com> - 2.3.6-7
changelog:
  - Bump version to 2.3.6-7
  - Resolve: rhbz#2251260 - dsconf replication status fails with 'Invalid credentials' while trying to reuse initial credentials
  - Resolve: rhbz#2251031 - Crash on open/close connections
  - Resolve: rhbz#2251257 - ns-slapd crash in slapi_attr_basetype


author: Thierry Bordaz <tbordaz@redhat.com> - 2.3.6-8
changelog:
  - Bump version to 2.3.6-8
  - Resolve: rhbz#2251260 - dsconf replication status fails with 'Invalid credentials' while trying to reuse initial credentials
  - Resolve: rhbz#2251031 - Crash on open/close connections
  - Resolve: rhbz#2251257 - ns-slapd crash in slapi_attr_basetype


author: Thierry Bordaz <tbordaz@redhat.com> - 2.4.4-4
changelog:
  - Bump version to 2.4.4-4
  - Resolve: rhbz#2253478 - Rebase RHDS 12.4 with 389-ds-base-2.4
  - Resolve: rhbz#2253498 - ns-slapd crash in slapi_attr_basetype


author: Thierry Bordaz <tbordaz@redhat.com> - 2.4.5-2
changelog:
  - Bump version to 2.4.5-2
  - Resolves: rhbz@2258623 - Rebase RHDS 12.4 with 389-ds-base-2.4.5
  - Resolves: rhbz#2258594 - [RFE] Add PROXY protocol support to 389-ds-base
  - Resolves: rhbz#2258598 - [RFE] Provide a history for 'LastLoginTime'
  - Resolves: rhbz#2258606 - [RFE] inChain Matching Rule
  - Resolves: rhbz#2258609 - [RFE] Disable Transparent Huge Pages when using large caches


author: James Chapman <jachapma@redhat.com> - 2.4.5-3
changelog:
  - Bump version to 2.4.5-3
  - Resolves: rhbz#2258594 - RFE Add PROXY protocol support to 389-ds-base via confiuration item - similar to Postfix
  - Resolves: rhbz#2090119 - Typo in Account Policy plugin message
  - Resolves: rhbz#2272070 - Fix spec file license tag
  - Resolves: rhbz#2272071 - Update spec file crate versions


author: James Chapman <jachapma@redhat.com> - 2.4.5-4
changelog:
  - Bump version to 2.4.5-4
  - Resolves: rhbz#2267978 - redhat-ds:12/389-ds-base: Malformed userPassword may cause crash at do_modify in slapd/modify.c
  - Resolves: rhbz#2290379 - redhat-ds:12/389-ds-base: potential denial of service via specially crafted kerberos AS-REQ request


author: James Chapman <jachapma@redhat.com> - 2.4.5-5
changelog:
  - Bump version to 2.4.5-5
  - Resolves: DIRSRV-110 - subsuffix are not returned in one level scoped search


author: James Chapman <jachapma@redhat.com> - 2.4.5-6
changelog:
  - Bump version to 2.4.5-6
  - Resolves: DIRSRV-111 - perf search result investigation for many large static groups and members


author: James Chapman <jachapma@redhat.com> - 2.4.5-7
changelog:
  - Bump version to 2.4.5-7
  - Resolves: rhbz#2294858 - 389-ds-base: unauthenticated user can trigger a DoS by sending a specific extended search request
  - Resolves: DIRSRV-137 - redhat-ds:12/389-ds-base: Malformed userPassword hash may cause Denial of Service


author: James Chapman <jachapma@redhat.com> - 2.5.1-1
changelog:
  - Bump version to 2.5.1-1
  - Resolves: rhbz#2290549 - redhat-ds:12/389-ds-base: potential denial of service via specially crafted kerberos AS-REQ request


author: James Chapman <jachapma@redhat.com> - 2.5.1-2
changelog:
  - Bump version to 2.5.1-2
  - Due to demodularisation RHDS is now cockpit-389-ds only, taking 389-ds-base from RHEL.


author: Viktor Ashirov <vashirov@redhat.com> - 2.5.2-3
changelog:
  - Bump version to 2.5.2-3
  - Resolves: DIRSRV-37: add the bundled JS libraries in the spec file, for easier tracking purpose
  - Resolves: DIRSRV-185: WebUI supports only instances with BDB


