Red Hat Security Advisory

RHSA-2019:3401

389-ds:1.4 security, bug fix, and enhancement update

Released 2019-11-05 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 8) 389-ds-base-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f.aarch64::389-ds:1.4, 389-ds-base-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f.ppc64le::389-ds:1.4, 389-ds-base-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f.s390x::389-ds:1.4 +19

TI-2019-02893 CVE-2019-3883 · GHSA-c65q-p9xj-798w

MEDIUM 44

In 389-ds-base up to version 1.4.1.2, requests are handled by workers threads.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.08202 Published 2019-04-17 Partial fix CWE-772

TI-2018-07685 CVE-2018-10871 · GHSA-pxxp-9p24-326h

LOW 34

389-ds-base before versions 1.3.8.5, 1.4.0.12 is vulnerable to a Cleartext Storage of Sensitive Information.

CVSS 3.0HIGH 7.2 Network High privileges No interaction EPSS 0.01127 Published 2018-07-18 Partial fix CWE-312

TI-2019-11029 CVE-2019-14824 · GHSA-8wxh-5wv6-x378

LOW 31

A flaw was found in the 'deref' plugin of 389-ds-base where it could use the 'search' permission to display attribute values.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01306 Published 2019-11-08 Partial fix CWE-732

TI-2019-07544 CVE-2019-10224 · GHSA-349x-pch6-942w

LOW 21

A flaw has been found in 389-ds-base versions 1.4.x.x before 1.4.1.3.

CVSS 3.1MEDIUM 4.6 Physical No auth No interaction EPSS 0.00396 Published 2019-11-25 Fixed CWE-522