openSUSE-SU-2019:1397-1

See a problem?
Import Source
https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2019:1397-1.json
JSON Data
https://api.osv.dev/v1/vulns/openSUSE-SU-2019:1397-1
Related
Published
2019-05-15T14:46:47Z
Modified
2019-05-15T14:46:47Z
Summary
Security update for 389-ds
Details

This update for 389-ds fixes the following issues:

The following security vulnerabilities were addressed:

  • CVE-2018-10850: Fixed a race condition on reference counter that would lead to a denial of service using persistent search (bsc#1096368)
  • CVE-2017-15134: Fixed a remote denial of service via search filters in slapifiltersprintf in slapd/util.c (bsc#1076530)
  • CVE-2017-15135: Fixed authentication bypass due to lack of size check in slapictmemcmp function in ch_malloc.c (bsc#1076530)
  • CVE-2018-10935: Fixed an issue that allowed users to cause a crash via ldapsearch with server side sorts (bsc#1105606)
  • CVE-2018-14624: The lock controlling the error log was not correctly used when re-opening the log file in log_erroremergency(), allowing an attacker to send a flood of modifications to a very large DN, which could have caused slapd to crash (bsc#1106699).

This update was imported from the SUSE:SLE-15:Update update project.

References

Affected packages

openSUSE:Leap 15.0 / 389-ds

Package

Name
389-ds
Purl
pkg:rpm/opensuse/389-ds&distro=openSUSE%20Leap%2015.0

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.4.0.3-lp150.3.3.1

Ecosystem specific 

{
    "binaries": [
        {
            "389-ds-snmp": "1.4.0.3-lp150.3.3.1",
            "389-ds": "1.4.0.3-lp150.3.3.1",
            "389-ds-devel": "1.4.0.3-lp150.3.3.1"
        }
    ]
}