Red Hat Security Advisory

RHSA-2017:2569

389-ds-base security and bug fix update

Released 2017-09-05 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Client Optional (v. 7) 389-ds-base-1.3.6.1-19.el7_4, 389-ds-base-devel-1.3.6.1-19.el7_4, 389-ds-base-libs-1.3.6.1-19.el7_4 +1
Red Hat Enterprise Linux ComputeNode Optional (v. 7) 389-ds-base-1.3.6.1-19.el7_4, 389-ds-base-devel-1.3.6.1-19.el7_4, 389-ds-base-libs-1.3.6.1-19.el7_4 +1
Red Hat Enterprise Linux Server (v. 7) 389-ds-base-1.3.6.1-19.el7_4, 389-ds-base-libs-1.3.6.1-19.el7_4
Red Hat Enterprise Linux Server Optional (v. 7) 389-ds-base-1.3.6.1-19.el7_4, 389-ds-base-devel-1.3.6.1-19.el7_4, 389-ds-base-libs-1.3.6.1-19.el7_4 +1
Red Hat Enterprise Linux Workstation (v. 7) 389-ds-base-1.3.6.1-19.el7_4, 389-ds-base-libs-1.3.6.1-19.el7_4
Red Hat Enterprise Linux Workstation Optional (v. 7) 389-ds-base-devel-1.3.6.1-19.el7_4, 389-ds-base-snmp-1.3.6.1-19.el7_4

Fixes 1 record

TI-2017-05192 CVE-2017-7551 · GHSA-rr4q-qmwm-h86v

Information disclosure through error messages in 389-ds-base

MEDIUM 45

389-ds-base version before 1.3.5.19 and 1.3.6.7 are vulnerable to password brute-force attacks during account lockout due to different return codes returned on password attempts.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01418 Published 2017-08-16 Partial fix CWE-209