SUSE CVE-2020-35518

When binding against a DN during authentication, the reply from 389-ds-base will be different whether the DN exists or not. This can be used by an unauthenticated attacker to check the existence of an entry in the LDAP database...

SUSE CVE-2021-3514

When using a syncrepl client in 389-ds-base, an authenticated attacker can cause a NULL pointer dereference using a specially crafted query, causing a crash...

SUSE CVE-2021-3652

A flaw was found in 389-ds-base. If an asterisk is imported as password hashes, either accidentally or maliciously, then instead of being inactive, any password will successfully match during authentication. This flaw allows an attacker to successfully authenticate as a user whose password was...

SUSE CVE-2022-0996

A vulnerability was found in the 389 Directory Server that allows expired passwords to access the database to cause improper authentication...

Ubuntu: Security Advisory (USN-5231-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

389-ds-base: SIGSEGV in sync_repl

A flaw was found In 389-ds-base. When the Content Synchronization plugin is enabled, an authenticated user can reach a NULL pointer dereference using a specially crafted query. This flaw allows an authenticated attacker to cause a denial of service...

Amazon Linux 2 : 389-ds-base (ALAS-2021-1650)

The version of 389-ds-base installed on the remote host is prior to 1.3.10.2-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1650 advisory. When binding against a DN during authentication, the reply from 389-ds-base will be different whether the DN exists or not...

Moderate: Red Hat Security Advisory: 389-ds-base security update

An update for 389-ds-base is now available for Red Hat Enterprise Linux 9.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...

389-ds-base: SIGSEGV in sync_repl

A flaw was found In 389-ds-base. When the Content Synchronization plugin is enabled, an authenticated user can reach a NULL pointer dereference using a specially crafted query. This flaw allows an authenticated attacker to cause a denial of service...

RHEL 9 : 389-ds-base (RHSA-2022:8976)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:8976 advisory. 389 Directory Server is an LDAP version 3 LDAPv3 compliant server. The base packages include the Lightweight Directory Access Protocol LDAP...

389-ds-base: SIGSEGV in sync_repl

A flaw was found In 389-ds-base. When the Content Synchronization plugin is enabled, an authenticated user can reach a NULL pointer dereference using a specially crafted query. This flaw allows an authenticated attacker to cause a denial of service...

Amazon Linux 2 : 389-ds-base (ALAS-2022-1879)

The version of 389-ds-base installed on the remote host is prior to 1.3.10.2-17. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1879 advisory. A flaw was found In 389-ds-base. When the Content Synchronization plugin is enabled, an authenticated user can reach a NULL...

Medium: 389-ds-base

Issue Overview: A flaw was found In 389-ds-base. When the Content Synchronization plugin is enabled, an authenticated user can reach a NULL pointer dereference using a specially crafted query. This flaw allows an authenticated attacker to cause a denial of service. CVE-2022-2850 Affected Packages...

RHEL 8 : 389-ds:1.4 (RHSA-2022:8680)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:8680 advisory. 389 Directory Server is an LDAP version 3 LDAPv3 compliant server. The base packages include the Lightweight Directory Access Protocol LDAP server an...

Oracle Linux 9 : 389-ds-base (ELSA-2022-8162)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-8162 advisory. 2.1.3-4 - Bump version to 2.1.3-4 - Resolves: Bug 1872451 - Fix regression with dscreate template 2.1.3-3 - Bump version to 2.1.3-3 - Resolves: Bug...

389-ds-base security, bug fix, and enhancement update

2.1.3-4 - Bump version to 2.1.3-4 - Resolves: Bug 1872451 - Fix regression with dscreate template 2.1.3-3 - Bump version to 2.1.3-3 - Resolves: Bug 2118765 2.1.3-2 - Bump version to 2.1.3-2 - Resolves: Bug 2118765 - SIGSEGV in syncrepl 2.1.3-1 - Bump version to 2.1.3-1 - Resolves: Bug 2061801 -...

AlmaLinux 9 : 389-ds-base (ALSA-2022:8162)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:8162 advisory. - A vulnerability was discovered in the 389 Directory Server that allows an unauthenticated attacker with network access to the LDAP port to cause a denia...

SUSE SLES15 / openSUSE 15 Security Update : 389-ds (SUSE-SU-2022:4124-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:4124-1 advisory. - CVE-2021-45710: Fixed tokio data race with memory corruption bsc1194119. - Update to version 2.0.16git56.d15a0a7. - Failure ...

SUSE-SU-2022:4124-1 Security update for 389-ds

This update for 389-ds fixes the following issues: - CVE-2021-45710: Fixed tokio data race with memory corruption bsc1194119. - Update to version 2.0.16git56.d15a0a7. - Failure to migrate from openldap if pwdPolicyChecker present bsc1205146. - Resolve issue with checklist post migration when dds ...

Rocky Linux 8 : 389-ds:1.4 (RLSA-2022:7133)

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:7133 advisory. - A flaw was found In 389-ds-base. When the Content Synchronization plugin is enabled, an authenticated user can reach a NULL pointer dereference using a special...