Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2022:2105-1

Опубликовано: 16 июн. 2022
Источник: suse-cvrf

Описание

Security update for 389-ds

This update for 389-ds fixes the following issues:

  • CVE-2021-4091: Fixed double free in psearch (bsc#1195324).
  • CVE-2022-1949: Fixed full access control bypass with simple crafted query (bsc#1199889).

Список пакетов

SUSE Enterprise Storage 7
389-ds-1.4.3.30~git2.ca761af4b-150200.3.29.1
389-ds-devel-1.4.3.30~git2.ca761af4b-150200.3.29.1
lib389-1.4.3.30~git2.ca761af4b-150200.3.29.1
libsvrcore0-1.4.3.30~git2.ca761af4b-150200.3.29.1
SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS
389-ds-1.4.3.30~git2.ca761af4b-150200.3.29.1
389-ds-devel-1.4.3.30~git2.ca761af4b-150200.3.29.1
lib389-1.4.3.30~git2.ca761af4b-150200.3.29.1
libsvrcore0-1.4.3.30~git2.ca761af4b-150200.3.29.1
SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS
389-ds-1.4.3.30~git2.ca761af4b-150200.3.29.1
389-ds-devel-1.4.3.30~git2.ca761af4b-150200.3.29.1
lib389-1.4.3.30~git2.ca761af4b-150200.3.29.1
libsvrcore0-1.4.3.30~git2.ca761af4b-150200.3.29.1
SUSE Linux Enterprise Server 15 SP2-BCL
389-ds-1.4.3.30~git2.ca761af4b-150200.3.29.1
389-ds-devel-1.4.3.30~git2.ca761af4b-150200.3.29.1
lib389-1.4.3.30~git2.ca761af4b-150200.3.29.1
libsvrcore0-1.4.3.30~git2.ca761af4b-150200.3.29.1
SUSE Linux Enterprise Server 15 SP2-LTSS
389-ds-1.4.3.30~git2.ca761af4b-150200.3.29.1
389-ds-devel-1.4.3.30~git2.ca761af4b-150200.3.29.1
lib389-1.4.3.30~git2.ca761af4b-150200.3.29.1
libsvrcore0-1.4.3.30~git2.ca761af4b-150200.3.29.1
SUSE Linux Enterprise Server for SAP Applications 15 SP2
389-ds-1.4.3.30~git2.ca761af4b-150200.3.29.1
389-ds-devel-1.4.3.30~git2.ca761af4b-150200.3.29.1
lib389-1.4.3.30~git2.ca761af4b-150200.3.29.1
libsvrcore0-1.4.3.30~git2.ca761af4b-150200.3.29.1
SUSE Manager Proxy 4.1
389-ds-1.4.3.30~git2.ca761af4b-150200.3.29.1
389-ds-devel-1.4.3.30~git2.ca761af4b-150200.3.29.1
lib389-1.4.3.30~git2.ca761af4b-150200.3.29.1
libsvrcore0-1.4.3.30~git2.ca761af4b-150200.3.29.1
SUSE Manager Retail Branch Server 4.1
389-ds-1.4.3.30~git2.ca761af4b-150200.3.29.1
389-ds-devel-1.4.3.30~git2.ca761af4b-150200.3.29.1
lib389-1.4.3.30~git2.ca761af4b-150200.3.29.1
libsvrcore0-1.4.3.30~git2.ca761af4b-150200.3.29.1
SUSE Manager Server 4.1
389-ds-1.4.3.30~git2.ca761af4b-150200.3.29.1
389-ds-devel-1.4.3.30~git2.ca761af4b-150200.3.29.1
lib389-1.4.3.30~git2.ca761af4b-150200.3.29.1
libsvrcore0-1.4.3.30~git2.ca761af4b-150200.3.29.1

Ссылки

Описание

A double-free was found in the way 389-ds-base handles virtual attributes context in persistent searches. An attacker could send a series of search requests, forcing the server to behave unexpectedly, and crash.

Затронутые продукты
SUSE Enterprise Storage 7:389-ds-1.4.3.30~git2.ca761af4b-150200.3.29.1
SUSE Enterprise Storage 7:389-ds-devel-1.4.3.30~git2.ca761af4b-150200.3.29.1
SUSE Enterprise Storage 7:lib389-1.4.3.30~git2.ca761af4b-150200.3.29.1
SUSE Enterprise Storage 7:libsvrcore0-1.4.3.30~git2.ca761af4b-150200.3.29.1
Ссылки

Описание

An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would yield incorrect results, but as that has progressed, can be determined that it actually is an access control bypass. This may allow any remote unauthenticated user to issue a filter that allows searching for database items they do not have access to, including but not limited to potentially userPassword hashes and other sensitive data.

Затронутые продукты
SUSE Enterprise Storage 7:389-ds-1.4.3.30~git2.ca761af4b-150200.3.29.1
SUSE Enterprise Storage 7:389-ds-devel-1.4.3.30~git2.ca761af4b-150200.3.29.1
SUSE Enterprise Storage 7:lib389-1.4.3.30~git2.ca761af4b-150200.3.29.1
SUSE Enterprise Storage 7:libsvrcore0-1.4.3.30~git2.ca761af4b-150200.3.29.1
Ссылки
Уязвимость SUSE-SU-2022:2105-1