Tue Jan 21 21:23:01 UTC 202020200121212301

a/aaa_elflibs-15.0-x86_64-19.txz:  Rebuilt.
  Upgraded:  libcap.so.2.31, libgmp.so.10.4.0, libgmpxx.so.4.6.0.
  Added:  libgssapi_krb5.so.2.2, libk5crypto.so.3.1, libkrb5.so.3.3,
  libkrb5support.so.0.1.
a/util-linux-2.35-x86_64-1.txz:  Upgraded.
d/python-pip-20.0.1-x86_64-1.txz:  Upgraded.
l/Mako-1.1.1-x86_64-1.txz:  Upgraded.
l/keyutils-1.6.1-x86_64-1.txz:  Upgraded.
n/krb5-1.17-x86_64-1.txz:  Added.
  Nothing links to this yet, but we'll need it soon enough. :-)
n/php-7.4.2-x86_64-1.txz:  Upgraded.
  This update fixes bugs and security issues:
  Standard: OOB read in php_strip_tags_ex
  Mbstring: global buffer-overflow in 'mbfl_filt_conv_big5_wchar'
  For more information, see:
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7059
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7060
  (* Security fix *)
n/samba-4.11.5-x86_64-1.txz:  Upgraded.
  This update fixes the following security issues:
  Replication of ACLs set to inherit down a subtree on AD Directory
  not automatic.
  Crash after failed character conversion at log level 3 or above.
  Use after free during DNS zone scavenging in Samba AD DC.
  For more information, see:
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14902
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14907
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19344
  (* Security fix *)
xap/gparted-1.1.0-x86_64-1.txz:  Upgraded.

1 files changed, 75 insertions, 0 deletions

diff --git a/source/n/krb5/patches/krb5-1.13-dirsrv-accountlock.patch b/source/n/krb5/patches/krb5-1.13-dirsrv-accountlock.patch
new file mode 100644
index 000000000..168b9ba0b
--- /dev/null
+++ b/source/n/krb5/patches/krb5-1.13-dirsrv-accountlock.patch
@@ -0,0 +1,75 @@
+From 0a33cb5ff8f80c62a652bc60860fad375ee58a85 Mon Sep 17 00:00:00 2001
+From: Robbie Harwood <rharwood@redhat.com>
+Date: Tue, 23 Aug 2016 16:47:44 -0400
+Subject: [PATCH] krb5-1.13-dirsrv-accountlock.patch
+
+Treat 'nsAccountLock: true' the same as 'loginDisabled: true'.  Updated from
+original version filed as RT#5891.
+---
+ src/aclocal.m4                                    |  9 +++++++++
+ src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c      | 17 +++++++++++++++++
+ src/plugins/kdb/ldap/libkdb_ldap/ldap_principal.c |  3 +++
+ 3 files changed, 29 insertions(+)
+
+diff --git a/src/aclocal.m4 b/src/aclocal.m4
+index f5667c3..2bfb994 100644
+--- a/src/aclocal.m4
++++ b/src/aclocal.m4
+@@ -1656,6 +1656,15 @@ if test "$with_ldap" = yes; then
+   AC_MSG_NOTICE(enabling OpenLDAP database backend module support)
+   OPENLDAP_PLUGIN=yes
+ fi
++AC_ARG_WITH([dirsrv-account-locking],
++[  --with-dirsrv-account-locking       compile 389/Red Hat/Fedora/Netscape Directory Server database backend module],
++[case "$withval" in
++    yes | no) ;;
++    *)  AC_MSG_ERROR(Invalid option value --with-dirsrv-account-locking="$withval") ;;
++esac], with_dirsrv_account_locking=no)
++if test $with_dirsrv_account_locking = yes; then
++    AC_DEFINE(HAVE_DIRSRV_ACCOUNT_LOCKING,1,[Define if LDAP KDB interface should heed 389 DS's nsAccountLock attribute.])
++fi
+ ])dnl
+ dnl
+ dnl If libkeyutils exists (on Linux) include it and use keyring ccache
+diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c
+index 32efc4f..af8b2db 100644
+--- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c
++++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c
+@@ -1674,6 +1674,23 @@ populate_krb5_db_entry(krb5_context context, krb5_ldap_context *ldap_context,
+     ret = krb5_dbe_update_tl_data(context, entry, &userinfo_tl_data);
+     if (ret)
+         goto cleanup;
++#ifdef HAVE_DIRSRV_ACCOUNT_LOCKING
++    {
++        krb5_timestamp              expiretime=0;
++        char                        *is_login_disabled=NULL;
++
++        /* LOGIN DISABLED */
++        ret = krb5_ldap_get_string(ld, ent, "nsAccountLock", &is_login_disabled,
++                                   &attr_present);
++        if (ret)
++            goto cleanup;
++        if (attr_present == TRUE) {
++            if (strcasecmp(is_login_disabled, "TRUE")== 0)
++                entry->attributes |= KRB5_KDB_DISALLOW_ALL_TIX;
++            free (is_login_disabled);
++        }
++    }
++#endif
+ 
+     ret = krb5_read_tkt_policy(context, ldap_context, entry, tktpolname);
+     if (ret)
+diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal.c
+index d722dbf..5e8e9a8 100644
+--- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal.c
++++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal.c
+@@ -54,6 +54,9 @@ char     *principal_attributes[] = { "krbprincipalname",
+                                      "krbLastFailedAuth",
+                                      "krbLoginFailedCount",
+                                      "krbLastSuccessfulAuth",
++#ifdef HAVE_DIRSRV_ACCOUNT_LOCKING
++                                     "nsAccountLock",
++#endif
+                                      "krbLastPwdChange",
+                                      "krbLastAdminUnlock",
+                                      "krbPrincipalAuthInd",