Red Hat Security Advisory

RHSA-2018:0414

389-ds-base security and bug fix update

Released 2018-03-06 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Client Optional (v. 7) 389-ds-base-1.3.6.1-28.el7_4, 389-ds-base-devel-1.3.6.1-28.el7_4, 389-ds-base-libs-1.3.6.1-28.el7_4 +1
Red Hat Enterprise Linux ComputeNode Optional (v. 7) 389-ds-base-1.3.6.1-28.el7_4, 389-ds-base-devel-1.3.6.1-28.el7_4, 389-ds-base-libs-1.3.6.1-28.el7_4 +1
Red Hat Enterprise Linux Server (v. 7) 389-ds-base-1.3.6.1-28.el7_4, 389-ds-base-libs-1.3.6.1-28.el7_4
Red Hat Enterprise Linux Server Optional (v. 7) 389-ds-base-1.3.6.1-28.el7_4, 389-ds-base-devel-1.3.6.1-28.el7_4, 389-ds-base-libs-1.3.6.1-28.el7_4 +1
Red Hat Enterprise Linux Workstation (v. 7) 389-ds-base-1.3.6.1-28.el7_4, 389-ds-base-libs-1.3.6.1-28.el7_4
Red Hat Enterprise Linux Workstation Optional (v. 7) 389-ds-base-devel-1.3.6.1-28.el7_4, 389-ds-base-snmp-1.3.6.1-28.el7_4
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) 389-ds-base-1.3.6.1-28.el7_4, 389-ds-base-libs-1.3.6.1-28.el7_4
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) 389-ds-base-1.3.6.1-28.el7_4, 389-ds-base-devel-1.3.6.1-28.el7_4, 389-ds-base-snmp-1.3.6.1-28.el7_4

Fixes 2 records

TI-2017-11105 CVE-2017-15135 · GHSA-frrc-qvjw-hwj9

Improper authentication in Red Hat 389-ds-base

MEDIUM 42

It was found that 389-ds-base since 1.3.6.1 up to and including 1.4.0.3 did not always handle internal hash comparison operations correctly during the authentication process.

CVSS 3.0HIGH 8.1 Network No auth No interaction EPSS 0.03828 Published 2018-01-24 Fixed CWE-287

TI-2018-00975 CVE-2018-1054 · GHSA-g83g-r7vx-57fv

Buffer overflow in Red Hat 389-ds-base

MEDIUM 40

An out-of-bounds memory read flaw was found in the way 389-ds-base handled certain LDAP search filters, affecting all versions including 1.4.x.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.0456 Published 2018-03-07 Fixed CWE-120