Security update for 389-ds SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:2163-1 Final 1 1 2022-06-23T12:34:06Z current 2022-06-23T12:34:06Z 2022-06-23T12:34:06Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for 389-ds This update for 389-ds fixes the following issues: - CVE-2022-1949: Fixed full access control bypass with simple crafted query (bsc#1199889). - CVE-2022-0918: Fixed denial of service issue via crafted messages (bsc#1197275). - CVE-2022-0996: Fixed mishandling of password expiry (bsc#1197345). - CVE-2021-4091: Fixed double free in psearch (bsc#1195324). - CVE-2021-3652: Fixed disabled accounts may be able to bind with crypt passwords (bsc#1188455). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2022-2163,SUSE-SLE-Product-HPC-15-SP1-ESPOS-2022-2163,SUSE-SLE-Product-HPC-15-SP1-LTSS-2022-2163,SUSE-SLE-Product-SLES-15-SP1-BCL-2022-2163,SUSE-SLE-Product-SLES-15-SP1-LTSS-2022-2163,SUSE-SLE-Product-SLES_SAP-15-SP1-2022-2163,SUSE-Storage-6-2022-2163 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20222163-1/ Link for SUSE-SU-2022:2163-1 https://lists.suse.com/pipermail/sle-security-updates/2022-June/011338.html E-Mail link for SUSE-SU-2022:2163-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1188455 SUSE Bug 1188455 https://bugzilla.suse.com/1195324 SUSE Bug 1195324 https://bugzilla.suse.com/1197275 SUSE Bug 1197275 https://bugzilla.suse.com/1197345 SUSE Bug 1197345 https://bugzilla.suse.com/1199889 SUSE Bug 1199889 https://bugzilla.suse.com/1200175 SUSE Bug 1200175 https://www.suse.com/security/cve/CVE-2021-3652/ SUSE CVE CVE-2021-3652 page https://www.suse.com/security/cve/CVE-2021-4091/ SUSE CVE CVE-2021-4091 page https://www.suse.com/security/cve/CVE-2022-0918/ SUSE CVE CVE-2022-0918 page https://www.suse.com/security/cve/CVE-2022-0996/ SUSE CVE CVE-2022-0996 page https://www.suse.com/security/cve/CVE-2022-1949/ SUSE CVE CVE-2022-1949 page SUSE Enterprise Storage 6 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS SUSE Linux Enterprise Server 15 SP1-BCL SUSE Linux Enterprise Server 15 SP1-LTSS SUSE Linux Enterprise Server for SAP Applications 15 SP1 389-ds-1.4.2.16~git68.efa843752-150100.7.34.1 389-ds-devel-1.4.2.16~git68.efa843752-150100.7.34.1 389-ds-snmp-1.4.2.16~git68.efa843752-150100.7.34.1 lib389-1.4.2.16~git68.efa843752-150100.7.34.1 libsvrcore0-1.4.2.16~git68.efa843752-150100.7.34.1 389-ds-1.4.2.16~git68.efa843752-150100.7.34.1 as a component of SUSE Enterprise Storage 6 389-ds-devel-1.4.2.16~git68.efa843752-150100.7.34.1 as a component of SUSE Enterprise Storage 6 389-ds-snmp-1.4.2.16~git68.efa843752-150100.7.34.1 as a component of SUSE Enterprise Storage 6 lib389-1.4.2.16~git68.efa843752-150100.7.34.1 as a component of SUSE Enterprise Storage 6 libsvrcore0-1.4.2.16~git68.efa843752-150100.7.34.1 as a component of SUSE Enterprise Storage 6 389-ds-1.4.2.16~git68.efa843752-150100.7.34.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS 389-ds-devel-1.4.2.16~git68.efa843752-150100.7.34.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS 389-ds-snmp-1.4.2.16~git68.efa843752-150100.7.34.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS lib389-1.4.2.16~git68.efa843752-150100.7.34.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS libsvrcore0-1.4.2.16~git68.efa843752-150100.7.34.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS 389-ds-1.4.2.16~git68.efa843752-150100.7.34.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS 389-ds-devel-1.4.2.16~git68.efa843752-150100.7.34.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS 389-ds-snmp-1.4.2.16~git68.efa843752-150100.7.34.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS lib389-1.4.2.16~git68.efa843752-150100.7.34.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS libsvrcore0-1.4.2.16~git68.efa843752-150100.7.34.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS 389-ds-1.4.2.16~git68.efa843752-150100.7.34.1 as a component of SUSE Linux Enterprise Server 15 SP1-BCL 389-ds-devel-1.4.2.16~git68.efa843752-150100.7.34.1 as a component of SUSE Linux Enterprise Server 15 SP1-BCL 389-ds-snmp-1.4.2.16~git68.efa843752-150100.7.34.1 as a component of SUSE Linux Enterprise Server 15 SP1-BCL lib389-1.4.2.16~git68.efa843752-150100.7.34.1 as a component of SUSE Linux Enterprise Server 15 SP1-BCL libsvrcore0-1.4.2.16~git68.efa843752-150100.7.34.1 as a component of SUSE Linux Enterprise Server 15 SP1-BCL 389-ds-1.4.2.16~git68.efa843752-150100.7.34.1 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS 389-ds-devel-1.4.2.16~git68.efa843752-150100.7.34.1 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS 389-ds-snmp-1.4.2.16~git68.efa843752-150100.7.34.1 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS lib389-1.4.2.16~git68.efa843752-150100.7.34.1 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS libsvrcore0-1.4.2.16~git68.efa843752-150100.7.34.1 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS 389-ds-1.4.2.16~git68.efa843752-150100.7.34.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 389-ds-devel-1.4.2.16~git68.efa843752-150100.7.34.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 389-ds-snmp-1.4.2.16~git68.efa843752-150100.7.34.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 lib389-1.4.2.16~git68.efa843752-150100.7.34.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 libsvrcore0-1.4.2.16~git68.efa843752-150100.7.34.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 A flaw was found in 389-ds-base. If an asterisk is imported as password hashes, either accidentally or maliciously, then instead of being inactive, any password will successfully match during authentication. This flaw allows an attacker to successfully authenticate as a user whose password was disabled. CVE-2021-3652 SUSE Enterprise Storage 6:389-ds-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Enterprise Storage 6:389-ds-devel-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Enterprise Storage 6:389-ds-snmp-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Enterprise Storage 6:lib389-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Enterprise Storage 6:libsvrcore0-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:389-ds-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:389-ds-devel-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:389-ds-snmp-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:lib389-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:libsvrcore0-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:389-ds-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:389-ds-devel-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:389-ds-snmp-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:lib389-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libsvrcore0-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server 15 SP1-BCL:389-ds-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server 15 SP1-BCL:389-ds-devel-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server 15 SP1-BCL:389-ds-snmp-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server 15 SP1-BCL:lib389-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server 15 SP1-BCL:libsvrcore0-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server 15 SP1-LTSS:389-ds-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server 15 SP1-LTSS:389-ds-devel-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server 15 SP1-LTSS:389-ds-snmp-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server 15 SP1-LTSS:lib389-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server 15 SP1-LTSS:libsvrcore0-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:389-ds-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:389-ds-devel-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:389-ds-snmp-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:lib389-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:libsvrcore0-1.4.2.16~git68.efa843752-150100.7.34.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222163-1/ https://www.suse.com/security/cve/CVE-2021-3652.html CVE-2021-3652 https://bugzilla.suse.com/1188455 SUSE Bug 1188455 A double-free was found in the way 389-ds-base handles virtual attributes context in persistent searches. An attacker could send a series of search requests, forcing the server to behave unexpectedly, and crash. CVE-2021-4091 SUSE Enterprise Storage 6:389-ds-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Enterprise Storage 6:389-ds-devel-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Enterprise Storage 6:389-ds-snmp-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Enterprise Storage 6:lib389-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Enterprise Storage 6:libsvrcore0-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:389-ds-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:389-ds-devel-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:389-ds-snmp-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:lib389-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:libsvrcore0-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:389-ds-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:389-ds-devel-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:389-ds-snmp-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:lib389-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libsvrcore0-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server 15 SP1-BCL:389-ds-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server 15 SP1-BCL:389-ds-devel-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server 15 SP1-BCL:389-ds-snmp-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server 15 SP1-BCL:lib389-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server 15 SP1-BCL:libsvrcore0-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server 15 SP1-LTSS:389-ds-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server 15 SP1-LTSS:389-ds-devel-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server 15 SP1-LTSS:389-ds-snmp-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server 15 SP1-LTSS:lib389-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server 15 SP1-LTSS:libsvrcore0-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:389-ds-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:389-ds-devel-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:389-ds-snmp-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:lib389-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:libsvrcore0-1.4.2.16~git68.efa843752-150100.7.34.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222163-1/ https://www.suse.com/security/cve/CVE-2021-4091.html CVE-2021-4091 https://bugzilla.suse.com/1195324 SUSE Bug 1195324 A vulnerability was discovered in the 389 Directory Server that allows an unauthenticated attacker with network access to the LDAP port to cause a denial of service. The denial of service is triggered by a single message sent over a TCP connection, no bind or other authentication is required. The message triggers a segmentation fault that results in slapd crashing. CVE-2022-0918 SUSE Enterprise Storage 6:389-ds-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Enterprise Storage 6:389-ds-devel-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Enterprise Storage 6:389-ds-snmp-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Enterprise Storage 6:lib389-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Enterprise Storage 6:libsvrcore0-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:389-ds-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:389-ds-devel-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:389-ds-snmp-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:lib389-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:libsvrcore0-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:389-ds-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:389-ds-devel-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:389-ds-snmp-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:lib389-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libsvrcore0-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server 15 SP1-BCL:389-ds-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server 15 SP1-BCL:389-ds-devel-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server 15 SP1-BCL:389-ds-snmp-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server 15 SP1-BCL:lib389-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server 15 SP1-BCL:libsvrcore0-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server 15 SP1-LTSS:389-ds-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server 15 SP1-LTSS:389-ds-devel-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server 15 SP1-LTSS:389-ds-snmp-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server 15 SP1-LTSS:lib389-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server 15 SP1-LTSS:libsvrcore0-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:389-ds-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:389-ds-devel-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:389-ds-snmp-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:lib389-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:libsvrcore0-1.4.2.16~git68.efa843752-150100.7.34.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222163-1/ https://www.suse.com/security/cve/CVE-2022-0918.html CVE-2022-0918 https://bugzilla.suse.com/1197275 SUSE Bug 1197275 A vulnerability was found in the 389 Directory Server that allows expired passwords to access the database to cause improper authentication. CVE-2022-0996 SUSE Enterprise Storage 6:389-ds-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Enterprise Storage 6:389-ds-devel-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Enterprise Storage 6:389-ds-snmp-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Enterprise Storage 6:lib389-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Enterprise Storage 6:libsvrcore0-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:389-ds-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:389-ds-devel-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:389-ds-snmp-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:lib389-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:libsvrcore0-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:389-ds-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:389-ds-devel-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:389-ds-snmp-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:lib389-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libsvrcore0-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server 15 SP1-BCL:389-ds-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server 15 SP1-BCL:389-ds-devel-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server 15 SP1-BCL:389-ds-snmp-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server 15 SP1-BCL:lib389-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server 15 SP1-BCL:libsvrcore0-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server 15 SP1-LTSS:389-ds-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server 15 SP1-LTSS:389-ds-devel-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server 15 SP1-LTSS:389-ds-snmp-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server 15 SP1-LTSS:lib389-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server 15 SP1-LTSS:libsvrcore0-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:389-ds-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:389-ds-devel-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:389-ds-snmp-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:lib389-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:libsvrcore0-1.4.2.16~git68.efa843752-150100.7.34.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222163-1/ https://www.suse.com/security/cve/CVE-2022-0996.html CVE-2022-0996 https://bugzilla.suse.com/1197345 SUSE Bug 1197345 An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would yield incorrect results, but as that has progressed, can be determined that it actually is an access control bypass. This may allow any remote unauthenticated user to issue a filter that allows searching for database items they do not have access to, including but not limited to potentially userPassword hashes and other sensitive data. CVE-2022-1949 SUSE Enterprise Storage 6:389-ds-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Enterprise Storage 6:389-ds-devel-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Enterprise Storage 6:389-ds-snmp-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Enterprise Storage 6:lib389-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Enterprise Storage 6:libsvrcore0-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:389-ds-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:389-ds-devel-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:389-ds-snmp-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:lib389-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:libsvrcore0-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:389-ds-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:389-ds-devel-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:389-ds-snmp-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:lib389-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libsvrcore0-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server 15 SP1-BCL:389-ds-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server 15 SP1-BCL:389-ds-devel-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server 15 SP1-BCL:389-ds-snmp-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server 15 SP1-BCL:lib389-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server 15 SP1-BCL:libsvrcore0-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server 15 SP1-LTSS:389-ds-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server 15 SP1-LTSS:389-ds-devel-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server 15 SP1-LTSS:389-ds-snmp-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server 15 SP1-LTSS:lib389-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server 15 SP1-LTSS:libsvrcore0-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:389-ds-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:389-ds-devel-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:389-ds-snmp-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:lib389-1.4.2.16~git68.efa843752-150100.7.34.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:libsvrcore0-1.4.2.16~git68.efa843752-150100.7.34.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222163-1/ https://www.suse.com/security/cve/CVE-2022-1949.html CVE-2022-1949 https://bugzilla.suse.com/1199889 SUSE Bug 1199889