Skip to content
OpenAdvisories
Low ELSA-2021-3807 1 CVE

Low: 389-ds-base security and bug fix update (Oracle Linux 7)

Published Oct 13, 2021 · Updated Oct 13, 2021

Ecosystem: Oracle Linux

Summary

[1.3.10.2-13]
- Bump version to 1.3.10.2-13
- Resolves: Bug 2005399 - Internal unindexed searches in syncrepl
- Resolves: Bug 2005432 - CVE-2021-3652 389-ds:1.4/389-ds-base: CRYPT password hash with asterisk allows any bind attempt to succeed
- Resolves: Bug 2005434 - ACIs are being evaluated against the Replication Manager account in a replication context.
- Resolves: Bug 2005435 - A connection can be erroneously flagged as replication conn during evaluation of an aci with ip bind rule

Fixed packages 4

ReleasePackageFixed in
Oracle Linux · 7 389-ds-base 0:1.3.10.2-13.el7_9
Oracle Linux · 7 389-ds-base-devel 0:1.3.10.2-13.el7_9
Oracle Linux · 7 389-ds-base-libs 0:1.3.10.2-13.el7_9
Oracle Linux · 7 389-ds-base-snmp 0:1.3.10.2-13.el7_9

Vulnerabilities 1

  • Unscored —
    CVE-2021-3652

    A flaw was found in 389-ds-base. If an asterisk is imported as password hashes, either accidentally or maliciously, the…

    389-ds-base Debian