Summary
[2.4.5-9]
- Bump version to 2.4.5-9
- Resolves: RHEL-44323 - unauthenticated user can trigger a DoS by sending a specific extended search request
- Resolves: RHEL-40945 - Malformed userPassword hash may cause Denial of Service
- Resolves: RHEL-49457 - perf search result investigation for many large static groups and members
- Resolves: RHEL-49459 - subsuffix are not returned in one level scoped search
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | 389-ds-base | 0:2.4.5-9.el9_4 |
| Oracle Linux · 9 | 389-ds-base-devel | 0:2.4.5-9.el9_4 |
| Oracle Linux · 9 | 389-ds-base-libs | 0:2.4.5-9.el9_4 |
| Oracle Linux · 9 | python3-lib389 | 0:2.4.5-9.el9_4 |
Vulnerabilities 2
-
Medium 6.5
389-ds-base: unauthenticated user can trigger a dos by sending a specific extended search request
A flaw was found in the 389 Directory Server. This flaw allows an unauthenticated user to cause a systematic server crash while sending a specific extended search request, leading to a denial of service.
-
Medium 5.7
389-ds-base: malformed userpassword hash may cause denial of service
A denial of service vulnerability was found in the 389-ds-base LDAP server. This issue may allow an authenticated user to cause a server denial of service while attempting to log in with a user with a malformed hash in their password.