Security update for 389-ds SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:2295-1 Final 1 1 2022-07-06T11:34:50Z current 2022-07-06T11:34:50Z 2022-07-06T11:34:50Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for 389-ds This update for 389-ds fixes the following issues: - CVE-2021-4091: Fixed double free in psearch (bsc#1195324). - CVE-2022-1949: Fixed full access control bypass with simple crafted query (bsc#1199889). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Container suse/389-ds:latest-2022-2295,SUSE-2022-2295,SUSE-SLE-Module-Server-Applications-15-SP4-2022-2295,openSUSE-SLE-15.4-2022-2295 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20222295-1/ Link for SUSE-SU-2022:2295-1 https://lists.suse.com/pipermail/sle-security-updates/2022-July/011430.html E-Mail link for SUSE-SU-2022:2295-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1195324 SUSE Bug 1195324 https://bugzilla.suse.com/1199889 SUSE Bug 1199889 https://www.suse.com/security/cve/CVE-2021-4091/ SUSE CVE CVE-2021-4091 page https://www.suse.com/security/cve/CVE-2022-1949/ SUSE CVE CVE-2022-1949 page Container suse/389-ds:latest SUSE Linux Enterprise Module for Server Applications 15 SP4 openSUSE Leap 15.4 389-ds-2.0.15~git26.1ea6a6803-150400.3.5.1 lib389-2.0.15~git26.1ea6a6803-150400.3.5.1 libsvrcore0-2.0.15~git26.1ea6a6803-150400.3.5.1 389-ds-devel-2.0.15~git26.1ea6a6803-150400.3.5.1 389-ds-snmp-2.0.15~git26.1ea6a6803-150400.3.5.1 389-ds-2.0.15~git26.1ea6a6803-150400.3.5.1 as a component of Container suse/389-ds:latest lib389-2.0.15~git26.1ea6a6803-150400.3.5.1 as a component of Container suse/389-ds:latest libsvrcore0-2.0.15~git26.1ea6a6803-150400.3.5.1 as a component of Container suse/389-ds:latest 389-ds-2.0.15~git26.1ea6a6803-150400.3.5.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP4 389-ds-devel-2.0.15~git26.1ea6a6803-150400.3.5.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP4 lib389-2.0.15~git26.1ea6a6803-150400.3.5.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP4 libsvrcore0-2.0.15~git26.1ea6a6803-150400.3.5.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP4 389-ds-2.0.15~git26.1ea6a6803-150400.3.5.1 as a component of openSUSE Leap 15.4 389-ds-devel-2.0.15~git26.1ea6a6803-150400.3.5.1 as a component of openSUSE Leap 15.4 389-ds-snmp-2.0.15~git26.1ea6a6803-150400.3.5.1 as a component of openSUSE Leap 15.4 lib389-2.0.15~git26.1ea6a6803-150400.3.5.1 as a component of openSUSE Leap 15.4 libsvrcore0-2.0.15~git26.1ea6a6803-150400.3.5.1 as a component of openSUSE Leap 15.4 A double-free was found in the way 389-ds-base handles virtual attributes context in persistent searches. An attacker could send a series of search requests, forcing the server to behave unexpectedly, and crash. CVE-2021-4091 Container suse/389-ds:latest:389-ds-2.0.15~git26.1ea6a6803-150400.3.5.1 Container suse/389-ds:latest:lib389-2.0.15~git26.1ea6a6803-150400.3.5.1 Container suse/389-ds:latest:libsvrcore0-2.0.15~git26.1ea6a6803-150400.3.5.1 SUSE Linux Enterprise Module for Server Applications 15 SP4:389-ds-2.0.15~git26.1ea6a6803-150400.3.5.1 SUSE Linux Enterprise Module for Server Applications 15 SP4:389-ds-devel-2.0.15~git26.1ea6a6803-150400.3.5.1 SUSE Linux Enterprise Module for Server Applications 15 SP4:lib389-2.0.15~git26.1ea6a6803-150400.3.5.1 SUSE Linux Enterprise Module for Server Applications 15 SP4:libsvrcore0-2.0.15~git26.1ea6a6803-150400.3.5.1 openSUSE Leap 15.4:389-ds-2.0.15~git26.1ea6a6803-150400.3.5.1 openSUSE Leap 15.4:389-ds-devel-2.0.15~git26.1ea6a6803-150400.3.5.1 openSUSE Leap 15.4:389-ds-snmp-2.0.15~git26.1ea6a6803-150400.3.5.1 openSUSE Leap 15.4:lib389-2.0.15~git26.1ea6a6803-150400.3.5.1 openSUSE Leap 15.4:libsvrcore0-2.0.15~git26.1ea6a6803-150400.3.5.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222295-1/ https://www.suse.com/security/cve/CVE-2021-4091.html CVE-2021-4091 https://bugzilla.suse.com/1195324 SUSE Bug 1195324 An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would yield incorrect results, but as that has progressed, can be determined that it actually is an access control bypass. This may allow any remote unauthenticated user to issue a filter that allows searching for database items they do not have access to, including but not limited to potentially userPassword hashes and other sensitive data. CVE-2022-1949 Container suse/389-ds:latest:389-ds-2.0.15~git26.1ea6a6803-150400.3.5.1 Container suse/389-ds:latest:lib389-2.0.15~git26.1ea6a6803-150400.3.5.1 Container suse/389-ds:latest:libsvrcore0-2.0.15~git26.1ea6a6803-150400.3.5.1 SUSE Linux Enterprise Module for Server Applications 15 SP4:389-ds-2.0.15~git26.1ea6a6803-150400.3.5.1 SUSE Linux Enterprise Module for Server Applications 15 SP4:389-ds-devel-2.0.15~git26.1ea6a6803-150400.3.5.1 SUSE Linux Enterprise Module for Server Applications 15 SP4:lib389-2.0.15~git26.1ea6a6803-150400.3.5.1 SUSE Linux Enterprise Module for Server Applications 15 SP4:libsvrcore0-2.0.15~git26.1ea6a6803-150400.3.5.1 openSUSE Leap 15.4:389-ds-2.0.15~git26.1ea6a6803-150400.3.5.1 openSUSE Leap 15.4:389-ds-devel-2.0.15~git26.1ea6a6803-150400.3.5.1 openSUSE Leap 15.4:389-ds-snmp-2.0.15~git26.1ea6a6803-150400.3.5.1 openSUSE Leap 15.4:lib389-2.0.15~git26.1ea6a6803-150400.3.5.1 openSUSE Leap 15.4:libsvrcore0-2.0.15~git26.1ea6a6803-150400.3.5.1 critical 5 AV:N/AC:L/Au:N/C:P/I:N/A:N 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222295-1/ https://www.suse.com/security/cve/CVE-2022-1949.html CVE-2022-1949 https://bugzilla.suse.com/1199889 SUSE Bug 1199889