URL:
https://github.com/freeipa/freeipa/pull/1144
Author: germanparente
Title: #1144: Fix for
https://pagure.io/freeipa/issue/6884 as agreed in BZ.
Action: opened
PR body:
"""
The definitive fix to deal with the DS CVE would be to remove the ipaPermTargetFilter:
(objectclass=<objectclass value>) from the "Remove <Object>"
permissions during ipa-server-upgrade, for instance, and re-run the task to generate the
acl's (if this not done automatically when modifying the permission entry).
this has been also discussed in BZ1441262
https://bugzilla.redhat.com/show_bug.cgi?id=1441262
"""
To pull the PR as Git branch:
git remote add ghfreeipa
https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1144/head:pr1144
git checkout pr1144