Arch Linux Security Advisory ASA-202107-72 ========================================== Severity: Medium Date : 2021-07-27 CVE-ID : CVE-2021-3514 CVE-2021-3652 Package : 389-ds-base Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2206 Summary ======= The package 389-ds-base before version 2.0.7-1 is vulnerable to multiple issues including authentication bypass and denial of service. Resolution ========== Upgrade to 2.0.7-1. # pacman -Syu "389-ds-base>=2.0.7-1" The problems have been fixed upstream in version 2.0.7. Workaround ========== None. Description =========== - CVE-2021-3514 (denial of service) A security issue was found in 389-ds-base before version 2.0.5. When using a sync_repl client, an authenticated attacker can cause a NULL pointer dereference using a specially crafted query, causing a crash of 389-ds-base. - CVE-2021-3652 (authentication bypass) In 389-ds-base before version 2.0.7, it was found that if an asterisk is imported as a password hash, either accidentally or maliciously, then instead of being inactive, any password will successfully match during authentication. This would allow an attacker to successfully authenticate as a user who's password was supposedly disabled. Impact ====== An attacker could successfully authenticate as a user who's password was supposedly disabled. Furthermore, an authenticated attacker could crash the 389-ds-base server. References ========== https://bugzilla.redhat.com/show_bug.cgi?id=1952907 https://github.com/389ds/389-ds-base/issues/4711 https://github.com/389ds/389-ds-base/pull/4738 https://github.com/389ds/389-ds-base/commit/d7eef2fcfbab2ef8aa6ee0bf60f0a9b1... https://bugzilla.redhat.com/show_bug.cgi?id=1982782 https://github.com/389ds/389-ds-base/issues/4817 https://github.com/389ds/389-ds-base/pull/4819 https://github.com/389ds/389-ds-base/commit/aeb90eb0c41fc48541d983f323c627b2... https://security.archlinux.org/CVE-2021-3514 https://security.archlinux.org/CVE-2021-3652