Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-14824: A flaw was found in the 'deref' plugin of 389-ds-base where it could use the 'search' permission to display attribute values. In some configurations, this could allow an authenticated attacker to view private attributes, such as password hashes. 1747448: CVE-2019-14824 389-ds-base: Read permission check bypass via the deref plugin
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | 389-ds-base | 0:1.3.9.1-12.amzn2.0.1 |
| Amazon Linux · 2 | 389-ds-base-debuginfo | 0:1.3.9.1-12.amzn2.0.1 |
| Amazon Linux · 2 | 389-ds-base-devel | 0:1.3.9.1-12.amzn2.0.1 |
| Amazon Linux · 2 | 389-ds-base-libs | 0:1.3.9.1-12.amzn2.0.1 |
| Amazon Linux · 2 | 389-ds-base-snmp | 0:1.3.9.1-12.amzn2.0.1 |
Vulnerabilities 1
-
Medium 6.5
A flaw was found in the 'deref' plugin of 389-ds-base where it could use the 'search' permission to display attribute v…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2019-14824.html