[ASA-202107-72] 389-ds-base: multiple issues
diabonas at archlinux.org
Fri Jul 30 22:30:47 UTC 2021
Arch Linux Security Advisory ASA-202107-72
Date : 2021-07-27
CVE-ID : CVE-2021-3514 CVE-2021-3652
Package : 389-ds-base
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-2206
The package 389-ds-base before version 2.0.7-1 is vulnerable to
multiple issues including authentication bypass and denial of service.
Upgrade to 2.0.7-1.
# pacman -Syu "389-ds-base>=2.0.7-1"
The problems have been fixed upstream in version 2.0.7.
- CVE-2021-3514 (denial of service)
A security issue was found in 389-ds-base before version 2.0.5. When
using a sync_repl client, an authenticated attacker can cause a NULL
pointer dereference using a specially crafted query, causing a crash of
- CVE-2021-3652 (authentication bypass)
In 389-ds-base before version 2.0.7, it was found that if an asterisk
is imported as a password hash, either accidentally or maliciously,
then instead of being inactive, any password will successfully match
during authentication. This would allow an attacker to successfully
authenticate as a user who's password was supposedly disabled.
An attacker could successfully authenticate as a user who's password
was supposedly disabled. Furthermore, an authenticated attacker could
crash the 389-ds-base server.
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 833 bytes
Desc: not available
More information about the arch-security