Security update for 389-ds SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:2081-1 Final 1 1 2022-06-14T19:04:14Z current 2022-06-14T19:04:14Z 2022-06-14T19:04:14Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for 389-ds This update for 389-ds fixes the following issues: - CVE-2021-4091: Fixed double free in psearch (bsc#1195324). - CVE-2022-1949: Fixed full access control bypass with simple crafted query (bsc#1199889). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2022-2081,SUSE-SLE-Module-Server-Applications-15-SP3-2022-2081,openSUSE-SLE-15.3-2022-2081 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20222081-1/ Link for SUSE-SU-2022:2081-1 https://lists.suse.com/pipermail/sle-security-updates/2022-June/011288.html E-Mail link for SUSE-SU-2022:2081-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1195324 SUSE Bug 1195324 https://bugzilla.suse.com/1199889 SUSE Bug 1199889 https://www.suse.com/security/cve/CVE-2021-4091/ SUSE CVE CVE-2021-4091 page https://www.suse.com/security/cve/CVE-2022-1949/ SUSE CVE CVE-2022-1949 page SUSE Linux Enterprise Module for Server Applications 15 SP3 openSUSE Leap 15.3 389-ds-1.4.4.19~git38.9951c1101-150300.3.17.1 389-ds-devel-1.4.4.19~git38.9951c1101-150300.3.17.1 389-ds-snmp-1.4.4.19~git38.9951c1101-150300.3.17.1 lib389-1.4.4.19~git38.9951c1101-150300.3.17.1 libsvrcore0-1.4.4.19~git38.9951c1101-150300.3.17.1 389-ds-1.4.4.19~git38.9951c1101-150300.3.17.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP3 389-ds-devel-1.4.4.19~git38.9951c1101-150300.3.17.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP3 lib389-1.4.4.19~git38.9951c1101-150300.3.17.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP3 libsvrcore0-1.4.4.19~git38.9951c1101-150300.3.17.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP3 389-ds-1.4.4.19~git38.9951c1101-150300.3.17.1 as a component of openSUSE Leap 15.3 389-ds-devel-1.4.4.19~git38.9951c1101-150300.3.17.1 as a component of openSUSE Leap 15.3 389-ds-snmp-1.4.4.19~git38.9951c1101-150300.3.17.1 as a component of openSUSE Leap 15.3 lib389-1.4.4.19~git38.9951c1101-150300.3.17.1 as a component of openSUSE Leap 15.3 libsvrcore0-1.4.4.19~git38.9951c1101-150300.3.17.1 as a component of openSUSE Leap 15.3 A double-free was found in the way 389-ds-base handles virtual attributes context in persistent searches. An attacker could send a series of search requests, forcing the server to behave unexpectedly, and crash. CVE-2021-4091 SUSE Linux Enterprise Module for Server Applications 15 SP3:389-ds-1.4.4.19~git38.9951c1101-150300.3.17.1 SUSE Linux Enterprise Module for Server Applications 15 SP3:389-ds-devel-1.4.4.19~git38.9951c1101-150300.3.17.1 SUSE Linux Enterprise Module for Server Applications 15 SP3:lib389-1.4.4.19~git38.9951c1101-150300.3.17.1 SUSE Linux Enterprise Module for Server Applications 15 SP3:libsvrcore0-1.4.4.19~git38.9951c1101-150300.3.17.1 openSUSE Leap 15.3:389-ds-1.4.4.19~git38.9951c1101-150300.3.17.1 openSUSE Leap 15.3:389-ds-devel-1.4.4.19~git38.9951c1101-150300.3.17.1 openSUSE Leap 15.3:389-ds-snmp-1.4.4.19~git38.9951c1101-150300.3.17.1 openSUSE Leap 15.3:lib389-1.4.4.19~git38.9951c1101-150300.3.17.1 openSUSE Leap 15.3:libsvrcore0-1.4.4.19~git38.9951c1101-150300.3.17.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222081-1/ https://www.suse.com/security/cve/CVE-2021-4091.html CVE-2021-4091 https://bugzilla.suse.com/1195324 SUSE Bug 1195324 An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would yield incorrect results, but as that has progressed, can be determined that it actually is an access control bypass. This may allow any remote unauthenticated user to issue a filter that allows searching for database items they do not have access to, including but not limited to potentially userPassword hashes and other sensitive data. CVE-2022-1949 SUSE Linux Enterprise Module for Server Applications 15 SP3:389-ds-1.4.4.19~git38.9951c1101-150300.3.17.1 SUSE Linux Enterprise Module for Server Applications 15 SP3:389-ds-devel-1.4.4.19~git38.9951c1101-150300.3.17.1 SUSE Linux Enterprise Module for Server Applications 15 SP3:lib389-1.4.4.19~git38.9951c1101-150300.3.17.1 SUSE Linux Enterprise Module for Server Applications 15 SP3:libsvrcore0-1.4.4.19~git38.9951c1101-150300.3.17.1 openSUSE Leap 15.3:389-ds-1.4.4.19~git38.9951c1101-150300.3.17.1 openSUSE Leap 15.3:389-ds-devel-1.4.4.19~git38.9951c1101-150300.3.17.1 openSUSE Leap 15.3:389-ds-snmp-1.4.4.19~git38.9951c1101-150300.3.17.1 openSUSE Leap 15.3:lib389-1.4.4.19~git38.9951c1101-150300.3.17.1 openSUSE Leap 15.3:libsvrcore0-1.4.4.19~git38.9951c1101-150300.3.17.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222081-1/ https://www.suse.com/security/cve/CVE-2022-1949.html CVE-2022-1949 https://bugzilla.suse.com/1199889 SUSE Bug 1199889