Skip to content
OpenAdvisories
Medium ALAS2-2021-1650 1 CVE

Moderate: 389-ds-base security update (Amazon Linux 2)

Published Jun 16, 2021 · Updated Jun 22, 2021

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-35518: When binding against a DN during authentication, the reply from 389-ds-base will be different whether the DN exists or not. This can be used by an unauthenticated attacker to check the existence of an entry in the LDAP database. 1905565: CVE-2020-35518 389-ds-base: information disclosure during the binding of a DN

Fixed packages 5

ReleasePackageFixed in
Amazon Linux · 2 389-ds-base 0:1.3.10.2-12.amzn2.0.1
Amazon Linux · 2 389-ds-base-debuginfo 0:1.3.10.2-12.amzn2.0.1
Amazon Linux · 2 389-ds-base-devel 0:1.3.10.2-12.amzn2.0.1
Amazon Linux · 2 389-ds-base-libs 0:1.3.10.2-12.amzn2.0.1
Amazon Linux · 2 389-ds-base-snmp 0:1.3.10.2-12.amzn2.0.1

Vulnerabilities 1

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-35518.html