Security update for 389-ds SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:2109-1 Final 1 1 2022-06-16T13:26:57Z current 2022-06-16T13:26:57Z 2022-06-16T13:26:57Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for 389-ds This update for 389-ds fixes the following issues: - CVE-2021-3652: Fixed disabled accounts may be able to bind with crypt passwords (bsc#1188455). - CVE-2022-1949: Fixed full access control bypass with simple crafted query (bsc#1199889). - CVE-2021-4091: Fixed double free in psearch (bsc#1195324). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2022-2109,SUSE-SLE-Product-HPC-15-2022-2109,SUSE-SLE-Product-SLES-15-2022-2109,SUSE-SLE-Product-SLES_SAP-15-2022-2109 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20222109-1/ Link for SUSE-SU-2022:2109-1 https://lists.suse.com/pipermail/sle-security-updates/2022-June/011305.html E-Mail link for SUSE-SU-2022:2109-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1188455 SUSE Bug 1188455 https://bugzilla.suse.com/1195324 SUSE Bug 1195324 https://bugzilla.suse.com/1199889 SUSE Bug 1199889 https://www.suse.com/security/cve/CVE-2021-3652/ SUSE CVE CVE-2021-3652 page https://www.suse.com/security/cve/CVE-2021-4091/ SUSE CVE CVE-2021-4091 page https://www.suse.com/security/cve/CVE-2022-1949/ SUSE CVE CVE-2022-1949 page SUSE Linux Enterprise High Performance Computing 15-ESPOS SUSE Linux Enterprise High Performance Computing 15-LTSS SUSE Linux Enterprise Server 15-LTSS SUSE Linux Enterprise Server for SAP Applications 15 389-ds-1.4.0.31~git15.8b9843b0b-150000.4.27.1 389-ds-devel-1.4.0.31~git15.8b9843b0b-150000.4.27.1 389-ds-snmp-1.4.0.31~git15.8b9843b0b-150000.4.27.1 libsvrcore0-1.4.0.31~git15.8b9843b0b-150000.4.27.1 libsvrcore0-64bit-1.4.0.31~git15.8b9843b0b-150000.4.27.1 389-ds-1.4.0.31~git15.8b9843b0b-150000.4.27.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS 389-ds-devel-1.4.0.31~git15.8b9843b0b-150000.4.27.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS libsvrcore0-1.4.0.31~git15.8b9843b0b-150000.4.27.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS 389-ds-1.4.0.31~git15.8b9843b0b-150000.4.27.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS 389-ds-devel-1.4.0.31~git15.8b9843b0b-150000.4.27.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS libsvrcore0-1.4.0.31~git15.8b9843b0b-150000.4.27.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS 389-ds-1.4.0.31~git15.8b9843b0b-150000.4.27.1 as a component of SUSE Linux Enterprise Server 15-LTSS 389-ds-devel-1.4.0.31~git15.8b9843b0b-150000.4.27.1 as a component of SUSE Linux Enterprise Server 15-LTSS libsvrcore0-1.4.0.31~git15.8b9843b0b-150000.4.27.1 as a component of SUSE Linux Enterprise Server 15-LTSS 389-ds-1.4.0.31~git15.8b9843b0b-150000.4.27.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 389-ds-devel-1.4.0.31~git15.8b9843b0b-150000.4.27.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 libsvrcore0-1.4.0.31~git15.8b9843b0b-150000.4.27.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 A flaw was found in 389-ds-base. If an asterisk is imported as password hashes, either accidentally or maliciously, then instead of being inactive, any password will successfully match during authentication. This flaw allows an attacker to successfully authenticate as a user whose password was disabled. CVE-2021-3652 SUSE Linux Enterprise High Performance Computing 15-ESPOS:389-ds-1.4.0.31~git15.8b9843b0b-150000.4.27.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:389-ds-devel-1.4.0.31~git15.8b9843b0b-150000.4.27.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:libsvrcore0-1.4.0.31~git15.8b9843b0b-150000.4.27.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:389-ds-1.4.0.31~git15.8b9843b0b-150000.4.27.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:389-ds-devel-1.4.0.31~git15.8b9843b0b-150000.4.27.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:libsvrcore0-1.4.0.31~git15.8b9843b0b-150000.4.27.1 SUSE Linux Enterprise Server 15-LTSS:389-ds-1.4.0.31~git15.8b9843b0b-150000.4.27.1 SUSE Linux Enterprise Server 15-LTSS:389-ds-devel-1.4.0.31~git15.8b9843b0b-150000.4.27.1 SUSE Linux Enterprise Server 15-LTSS:libsvrcore0-1.4.0.31~git15.8b9843b0b-150000.4.27.1 SUSE Linux Enterprise Server for SAP Applications 15:389-ds-1.4.0.31~git15.8b9843b0b-150000.4.27.1 SUSE Linux Enterprise Server for SAP Applications 15:389-ds-devel-1.4.0.31~git15.8b9843b0b-150000.4.27.1 SUSE Linux Enterprise Server for SAP Applications 15:libsvrcore0-1.4.0.31~git15.8b9843b0b-150000.4.27.1 moderate 6.4 AV:N/AC:L/Au:N/C:P/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222109-1/ https://www.suse.com/security/cve/CVE-2021-3652.html CVE-2021-3652 https://bugzilla.suse.com/1188455 SUSE Bug 1188455 A double-free was found in the way 389-ds-base handles virtual attributes context in persistent searches. An attacker could send a series of search requests, forcing the server to behave unexpectedly, and crash. CVE-2021-4091 SUSE Linux Enterprise High Performance Computing 15-ESPOS:389-ds-1.4.0.31~git15.8b9843b0b-150000.4.27.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:389-ds-devel-1.4.0.31~git15.8b9843b0b-150000.4.27.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:libsvrcore0-1.4.0.31~git15.8b9843b0b-150000.4.27.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:389-ds-1.4.0.31~git15.8b9843b0b-150000.4.27.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:389-ds-devel-1.4.0.31~git15.8b9843b0b-150000.4.27.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:libsvrcore0-1.4.0.31~git15.8b9843b0b-150000.4.27.1 SUSE Linux Enterprise Server 15-LTSS:389-ds-1.4.0.31~git15.8b9843b0b-150000.4.27.1 SUSE Linux Enterprise Server 15-LTSS:389-ds-devel-1.4.0.31~git15.8b9843b0b-150000.4.27.1 SUSE Linux Enterprise Server 15-LTSS:libsvrcore0-1.4.0.31~git15.8b9843b0b-150000.4.27.1 SUSE Linux Enterprise Server for SAP Applications 15:389-ds-1.4.0.31~git15.8b9843b0b-150000.4.27.1 SUSE Linux Enterprise Server for SAP Applications 15:389-ds-devel-1.4.0.31~git15.8b9843b0b-150000.4.27.1 SUSE Linux Enterprise Server for SAP Applications 15:libsvrcore0-1.4.0.31~git15.8b9843b0b-150000.4.27.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222109-1/ https://www.suse.com/security/cve/CVE-2021-4091.html CVE-2021-4091 https://bugzilla.suse.com/1195324 SUSE Bug 1195324 An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would yield incorrect results, but as that has progressed, can be determined that it actually is an access control bypass. This may allow any remote unauthenticated user to issue a filter that allows searching for database items they do not have access to, including but not limited to potentially userPassword hashes and other sensitive data. CVE-2022-1949 SUSE Linux Enterprise High Performance Computing 15-ESPOS:389-ds-1.4.0.31~git15.8b9843b0b-150000.4.27.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:389-ds-devel-1.4.0.31~git15.8b9843b0b-150000.4.27.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:libsvrcore0-1.4.0.31~git15.8b9843b0b-150000.4.27.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:389-ds-1.4.0.31~git15.8b9843b0b-150000.4.27.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:389-ds-devel-1.4.0.31~git15.8b9843b0b-150000.4.27.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:libsvrcore0-1.4.0.31~git15.8b9843b0b-150000.4.27.1 SUSE Linux Enterprise Server 15-LTSS:389-ds-1.4.0.31~git15.8b9843b0b-150000.4.27.1 SUSE Linux Enterprise Server 15-LTSS:389-ds-devel-1.4.0.31~git15.8b9843b0b-150000.4.27.1 SUSE Linux Enterprise Server 15-LTSS:libsvrcore0-1.4.0.31~git15.8b9843b0b-150000.4.27.1 SUSE Linux Enterprise Server for SAP Applications 15:389-ds-1.4.0.31~git15.8b9843b0b-150000.4.27.1 SUSE Linux Enterprise Server for SAP Applications 15:389-ds-devel-1.4.0.31~git15.8b9843b0b-150000.4.27.1 SUSE Linux Enterprise Server for SAP Applications 15:libsvrcore0-1.4.0.31~git15.8b9843b0b-150000.4.27.1 critical 5 AV:N/AC:L/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222109-1/ https://www.suse.com/security/cve/CVE-2022-1949.html CVE-2022-1949 https://bugzilla.suse.com/1199889 SUSE Bug 1199889