Moderate: 389-ds:1.4 security and bug fix update

2021-06-2914:00:08

Google

osv.dev

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

7.2 High

AI Score

Confidence

High

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:N/A:P

0.001 Low

EPSS

Percentile

23.8%

JSON

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

Security Fix(es):

389-ds-base: sync_repl NULL pointer dereference in sync_create_state_control() (CVE-2021-3514)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

ACIs are being evaluated against the Replication Manager account in a replication context. (BZ#1968588)
A connection can be erroneously flagged as replication conn during evaluation of an aci with ip bind rule (BZ#1970791)
Large updates can reset the CLcache to the beginning of the changelog (BZ#1972721)
Changelog cache can upload updates from a wrong starting point (CSN) (BZ#1972738)