Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2022:2081-1

Опубликовано: 14 июн. 2022
Источник: suse-cvrf

Описание

Security update for 389-ds

This update for 389-ds fixes the following issues:

  • CVE-2021-4091: Fixed double free in psearch (bsc#1195324).
  • CVE-2022-1949: Fixed full access control bypass with simple crafted query (bsc#1199889).

Список пакетов

SUSE Linux Enterprise Module for Server Applications 15 SP3
389-ds-1.4.4.19~git38.9951c1101-150300.3.17.1
389-ds-devel-1.4.4.19~git38.9951c1101-150300.3.17.1
lib389-1.4.4.19~git38.9951c1101-150300.3.17.1
libsvrcore0-1.4.4.19~git38.9951c1101-150300.3.17.1
openSUSE Leap 15.3
389-ds-1.4.4.19~git38.9951c1101-150300.3.17.1
389-ds-devel-1.4.4.19~git38.9951c1101-150300.3.17.1
389-ds-snmp-1.4.4.19~git38.9951c1101-150300.3.17.1
lib389-1.4.4.19~git38.9951c1101-150300.3.17.1
libsvrcore0-1.4.4.19~git38.9951c1101-150300.3.17.1

Ссылки

Описание

A double-free was found in the way 389-ds-base handles virtual attributes context in persistent searches. An attacker could send a series of search requests, forcing the server to behave unexpectedly, and crash.

Затронутые продукты
SUSE Linux Enterprise Module for Server Applications 15 SP3:389-ds-1.4.4.19~git38.9951c1101-150300.3.17.1
SUSE Linux Enterprise Module for Server Applications 15 SP3:389-ds-devel-1.4.4.19~git38.9951c1101-150300.3.17.1
SUSE Linux Enterprise Module for Server Applications 15 SP3:lib389-1.4.4.19~git38.9951c1101-150300.3.17.1
SUSE Linux Enterprise Module for Server Applications 15 SP3:libsvrcore0-1.4.4.19~git38.9951c1101-150300.3.17.1
Ссылки

Описание

An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would yield incorrect results, but as that has progressed, can be determined that it actually is an access control bypass. This may allow any remote unauthenticated user to issue a filter that allows searching for database items they do not have access to, including but not limited to potentially userPassword hashes and other sensitive data.

Затронутые продукты
SUSE Linux Enterprise Module for Server Applications 15 SP3:389-ds-1.4.4.19~git38.9951c1101-150300.3.17.1
SUSE Linux Enterprise Module for Server Applications 15 SP3:389-ds-devel-1.4.4.19~git38.9951c1101-150300.3.17.1
SUSE Linux Enterprise Module for Server Applications 15 SP3:lib389-1.4.4.19~git38.9951c1101-150300.3.17.1
SUSE Linux Enterprise Module for Server Applications 15 SP3:libsvrcore0-1.4.4.19~git38.9951c1101-150300.3.17.1
Ссылки