Add release notes for IPA 4.12.4

Author: antoniotorresm

src/index.rst

@@ -52,14 +52,14 @@ Releases
 .. toctree::
    :titlesonly:
 
+   /release-notes/4-12-4.rst
    /release-notes/4-12-3.rst
    /release-notes/4-12-2.rst
    /release-notes/4-12-1.rst
    /release-notes/4-11-2.rst
    /release-notes/4-12-0.rst
    /release-notes/4-11-1.rst
    /release-notes/4-10-3.rst
-   /release-notes/4-9-14.rst
 
 Getting involved
 ----------------

src/release-notes/4-12-4.rst

@@ -0,0 +1,127 @@
+FreeIPA 4.12.4
+==============
+
+.. raw:: mediawiki
+
+   {{ReleaseDate|2025-06-17}}
+
+The FreeIPA team would like to announce FreeIPA 4.12.4 release!
+
+It can be downloaded from http://www.freeipa.org/page/Downloads. Builds
+for Fedora distributions will be available from the official repository
+soon.
+
+.. _highlights_in_versions:
+
+Highlights in 4.12.4
+-------------------------
+
+-  CVE-2025-4404
+
+In 2020 the FreeIPA team implemented an enforcement to prevent a local
+account takeover on IPA-enrolled clients by aliasing the 'root' account
+to the 'admin' Kerberos principal so that only administrators can
+request a Kerberos ticket for the 'root' alias. This type of attack was
+later discovered in Active Directory as well by Samba Team and dubbed
+'Dollar ticket attack'
+(https://wiki.samba.org/index.php/Security/Dollar_Ticket_Attack).
+
+The FreeIPA Kerberos implementation enforces uniqueness across Kerberos
+principals to ensure that a canonical Kerberos principal name and its
+aliases cannot be assigned twice to different accounts. Newly created
+user accounts, host machine accounts, and Kerberos service accounts will
+always have the canonical Kerberos principal name also set as an alias
+for the same account.
+
+However, as a part of the change in
+https://pagure.io/freeipa/issue/8326, there was no additional
+enforcement of the canonical Kerberos principal name for a pre-defined
+'admin' account. This allowed another authenticated Kerberos principal
+with privileges to add Kerberos principal aliases to create a canonical
+name for a controlled service that matched the 'admin' account. With
+additional Kerberos client-side manipulation it became possible to trick
+a service application into accepting such a ticket as an 'admin'.
+
+It is not possible to escalate this attack through IPA API due to
+certain Kerberos protocol extensions enforcement in IPA API endpoint.
+However, there is a possibility to trick an IPA LDAP server into it
+directly once a broken configuration was introduced into the IPA
+deployment.
+
+The fix for CVE-2025-4404 is to enforce the 'admin' account's canonical
+Kerberos principal name. Additionally, an upgrade code looks at possible
+compromised Kerberos entries and removes 'admin' account aliases from
+those entries.
+
+We would like to express our gratitude to Mikhail Sukhov (Positive
+Technologies) for discovering this vulnerability and reporting it to Red
+Hat Product Security team and the FreeIPA project.
+
+Enhancements
+~~~~~~~~~~~~
+
+.. _known_issues:
+
+Known Issues
+~~~~~~~~~~~~
+
+.. _bug_fixes:
+
+Bug fixes
+~~~~~~~~~
+
+FreeIPA 4.12.4 is a security fix release.
+
+Details of the bug-fixes can be seen in the list of resolved tickets
+below.
+
+Upgrading
+---------
+
+Upgrade instructions are available on
+`Upgrade <https://www.freeipa.org/page/Upgrade>`__ page.
+
+Feedback
+--------
+
+Please provide comments, bugs and other feedback via the freeipa-users
+mailing list
+(https://lists.fedoraproject.org/archives/list/[email protected]/)
+or #freeipa channel on libera.chat.
+
+Resolved tickets
+----------------
+
+-  `#9777 <https://pagure.io/freeipa/issue/9777>`__ kdb:
+   ipadb_get_connection() succeeds but returns null LDAP context
+
+.. _detailed_changelog_since_4.12.3:
+
+Detailed changelog since 4.12.3
+-------------------------------
+
+.. _antonio_torres_1:
+
+Antonio Torres (1)
+~~~~~~~~~~~~~~~~~~
+
+-  Become IPA 4.12.4
+   `commit <https://pagure.io/freeipa/c/f2fc367fb00193a8ca8a1f22786fccd6b0024dac>`__
+
+.. _julien_rische_1:
+
+Julien Rische (1)
+~~~~~~~~~~~~~~~~~
+
+-  kdb: keep ipadb_get_connection() from succeeding with null LDAP
+   context
+   `commit <https://pagure.io/freeipa/c/6ae52a2fb451bbe57a4f0c584e14bca0274b85e8>`__
+   `#9777 <https://pagure.io/freeipa/issue/9777>`__
+
+.. _rob_crittenden_1:
+
+Rob Crittenden (1)
+~~~~~~~~~~~~~~~~~~
+
+-  Set krbCanonicalName=admin@REALM on the admin user
+   `commit <https://pagure.io/freeipa/c/e8c410ae5f7cdd36fecba66713ca94bd47465122>`__