Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2022.1680
389-ds:1.4 security and bug fix update
20 April 2022
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: 389-ds:1.4
Publisher: Red Hat
Operating System: Red Hat
Resolution: Patch/Upgrade
CVE Names: CVE-2021-4091
Original Bulletin:
https://access.redhat.com/errata/RHSA-2022:1410
Comment: CVSS (Max): 7.5 CVE-2021-4091 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS Source: Red Hat
Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Low: 389-ds:1.4 security and bug fix update
Advisory ID: RHSA-2022:1410-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2022:1410
Issue date: 2022-04-19
CVE Names: CVE-2021-4091
=====================================================================
1. Summary:
An update for the 389-ds:1.4 module is now available for Red Hat Enterprise
Linux 8.4 Extended Update Support.
Red Hat Product Security has rated this update as having a security impact
of Low. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux AppStream EUS (v.8.4) - aarch64, noarch, ppc64le, s390x, x86_64
3. Description:
389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The
base packages include the Lightweight Directory Access Protocol (LDAP)
server and command-line utilities for server administration.
Security Fix(es):
* 389-ds-base: double free of the virtual attribute context in persistent
search (CVE-2021-4091)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
Bug Fix(es):
* DB corruption "_entryrdn_insert_key - Same DN (dn:
nsuniqueid=ffffffff-ffffffff-ffffffff-ffffffff,<SUFFIX>) is already in the
entryrdn file" (BZ#2066800)
* IPA server (389ds) is very slow in execution of some searches
(`&(memberOf=...)(objectClass=ipaHost)` in particular) (BZ#2066801)
* monitor displays wrong date for connection (BZ#2066848)
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
5. Bugs fixed (https://bugzilla.redhat.com/):
2030307 - CVE-2021-4091 389-ds-base: double free of the virtual attribute context in persistent search
2066800 - DB corruption "_entryrdn_insert_key - Same DN (dn: nsuniqueid=ffffffff-ffffffff-ffffffff-ffffffff,<SUFFIX>) is already in the entryrdn file"
2066801 - IPA server (389ds) is very slow in execution of some searches (`&(memberOf=...)(objectClass=ipaHost)` in particular)
2066848 - monitor displays wrong date for connection
6. Package List:
Red Hat Enterprise Linux AppStream EUS (v.8.4):
Source:
389-ds-base-1.4.3.16-20.module+el8.4.0+14552+b182c759.src.rpm
aarch64:
389-ds-base-1.4.3.16-20.module+el8.4.0+14552+b182c759.aarch64.rpm
389-ds-base-debuginfo-1.4.3.16-20.module+el8.4.0+14552+b182c759.aarch64.rpm
389-ds-base-debugsource-1.4.3.16-20.module+el8.4.0+14552+b182c759.aarch64.rpm
389-ds-base-devel-1.4.3.16-20.module+el8.4.0+14552+b182c759.aarch64.rpm
389-ds-base-legacy-tools-1.4.3.16-20.module+el8.4.0+14552+b182c759.aarch64.rpm
389-ds-base-legacy-tools-debuginfo-1.4.3.16-20.module+el8.4.0+14552+b182c759.aarch64.rpm
389-ds-base-libs-1.4.3.16-20.module+el8.4.0+14552+b182c759.aarch64.rpm
389-ds-base-libs-debuginfo-1.4.3.16-20.module+el8.4.0+14552+b182c759.aarch64.rpm
389-ds-base-snmp-1.4.3.16-20.module+el8.4.0+14552+b182c759.aarch64.rpm
389-ds-base-snmp-debuginfo-1.4.3.16-20.module+el8.4.0+14552+b182c759.aarch64.rpm
noarch:
python3-lib389-1.4.3.16-20.module+el8.4.0+14552+b182c759.noarch.rpm
ppc64le:
389-ds-base-1.4.3.16-20.module+el8.4.0+14552+b182c759.ppc64le.rpm
389-ds-base-debuginfo-1.4.3.16-20.module+el8.4.0+14552+b182c759.ppc64le.rpm
389-ds-base-debugsource-1.4.3.16-20.module+el8.4.0+14552+b182c759.ppc64le.rpm
389-ds-base-devel-1.4.3.16-20.module+el8.4.0+14552+b182c759.ppc64le.rpm
389-ds-base-legacy-tools-1.4.3.16-20.module+el8.4.0+14552+b182c759.ppc64le.rpm
389-ds-base-legacy-tools-debuginfo-1.4.3.16-20.module+el8.4.0+14552+b182c759.ppc64le.rpm
389-ds-base-libs-1.4.3.16-20.module+el8.4.0+14552+b182c759.ppc64le.rpm
389-ds-base-libs-debuginfo-1.4.3.16-20.module+el8.4.0+14552+b182c759.ppc64le.rpm
389-ds-base-snmp-1.4.3.16-20.module+el8.4.0+14552+b182c759.ppc64le.rpm
389-ds-base-snmp-debuginfo-1.4.3.16-20.module+el8.4.0+14552+b182c759.ppc64le.rpm
s390x:
389-ds-base-1.4.3.16-20.module+el8.4.0+14552+b182c759.s390x.rpm
389-ds-base-debuginfo-1.4.3.16-20.module+el8.4.0+14552+b182c759.s390x.rpm
389-ds-base-debugsource-1.4.3.16-20.module+el8.4.0+14552+b182c759.s390x.rpm
389-ds-base-devel-1.4.3.16-20.module+el8.4.0+14552+b182c759.s390x.rpm
389-ds-base-legacy-tools-1.4.3.16-20.module+el8.4.0+14552+b182c759.s390x.rpm
389-ds-base-legacy-tools-debuginfo-1.4.3.16-20.module+el8.4.0+14552+b182c759.s390x.rpm
389-ds-base-libs-1.4.3.16-20.module+el8.4.0+14552+b182c759.s390x.rpm
389-ds-base-libs-debuginfo-1.4.3.16-20.module+el8.4.0+14552+b182c759.s390x.rpm
389-ds-base-snmp-1.4.3.16-20.module+el8.4.0+14552+b182c759.s390x.rpm
389-ds-base-snmp-debuginfo-1.4.3.16-20.module+el8.4.0+14552+b182c759.s390x.rpm
x86_64:
389-ds-base-1.4.3.16-20.module+el8.4.0+14552+b182c759.x86_64.rpm
389-ds-base-debuginfo-1.4.3.16-20.module+el8.4.0+14552+b182c759.x86_64.rpm
389-ds-base-debugsource-1.4.3.16-20.module+el8.4.0+14552+b182c759.x86_64.rpm
389-ds-base-devel-1.4.3.16-20.module+el8.4.0+14552+b182c759.x86_64.rpm
389-ds-base-legacy-tools-1.4.3.16-20.module+el8.4.0+14552+b182c759.x86_64.rpm
389-ds-base-legacy-tools-debuginfo-1.4.3.16-20.module+el8.4.0+14552+b182c759.x86_64.rpm
389-ds-base-libs-1.4.3.16-20.module+el8.4.0+14552+b182c759.x86_64.rpm
389-ds-base-libs-debuginfo-1.4.3.16-20.module+el8.4.0+14552+b182c759.x86_64.rpm
389-ds-base-snmp-1.4.3.16-20.module+el8.4.0+14552+b182c759.x86_64.rpm
389-ds-base-snmp-debuginfo-1.4.3.16-20.module+el8.4.0+14552+b182c759.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2021-4091
https://access.redhat.com/security/updates/classification/#low
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2022 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBYl7ul9zjgjWX9erEAQhcxg/9HAutJcNWHFMbkpHZEZupCBTm+F+4hV4X
7RpRa+QZv35GBEYMPPcdG6fGQ+HizL6JXYJ7PoMh4Tk4yvLLSDbV/DgGAu6otfMg
w6rY3LYC8NK2ddQmU5ERGU6SH8o0SCV++hMznrwEJYGIsmAQ5K3Iwh4umszrjNfF
5dTrCRDrPJKh8ToXKa99D5vC3WMHLFbNrHl3KQJLvFMEc7q5IkRB7X8wSY6flBml
CGoR49DjTGVeD746+n3il58ShxaTqq2e2MPl5ipKjGtsLmxaTPPvqzPlgvchyIuO
Czp9glJy6bhe2JnYGZf4nKLmlZCjm5d4CvAr1HzTvzymwrCVUnbLfHuRbBYZnoU8
p1wZUJJXummvngFjCGO7+oOKA5B13ZvJ6qSQJVRBu1r8LyTgFKLyUr5AgvZhAw0N
nJklqR9dOnpdFLEHyx9O3lDtD+K1mRndUvBpY4JtMYwqs8yMlvGabnahHvhdoCJ7
6tbr6F+x3o20zfA/4FvEopNUxoFjI8c07hK4UIdusH+x3veyH/MMMfLz35172/FW
0MCJ/1fS4tROH7L9pJhTecL49cQTntGfMf4TjKQO68fz34mjglOxRbVI84Yz92rz
F1bdxx8jc4ZLBfB4rTTvOsx4Hq2wAMqPZAEqDFilnx/viToRvbxkqbl3RCpr5FX6
a9hoUJbZW40=
=w/jo
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBYl9XeONLKJtyKPYoAQinbBAAsNuHBQwhY7h42AUE9JTevgJrriQE0XHr
Cxh3oV45MlL6+w6q7w27CA1iSZpBXsn43xwz0S8xe1F+pk6w2VWrDsIwTAqdc2t5
BPfUuGKYfohc5oW2bSlZfs4lmstSwCHfF9Tt5z/Y/2LVUTcEbNjaqAIxe8clkRhM
VyysEBeZhlcwallHR6oAtNwz082DS4mglOLQpwIMr+B6i5DyFrqphjj1+5Nt1+vR
swj4qZowzuRtnAQLljNjv44KMVNd+s1+SR39Sf/7AMt69u3VKafdhR/C4zrTGuq5
gMbCgOhEpzv8tO/PSnqqzBW1RBs56h4WBDGk/0msP1vDQlY2/Gk+vtB2ah6hqi7K
KSFfIeatq+26xKhALJMH0Zic1dBfRCAwGzJtdjXrktg4qMIVe98mCtCKi938LMnR
L+MOf5tlYAgle/c37Z1RTNSqdLISkejFVvPxbS69kL6pkY5kOTjGPVnr8MCAntBU
mUOowDE2NAH3hxREKZIoeY3egwmzM8/FzbJJFJ8jGJpccsKGpjtMJf7W5DIWIOGQ
VW8jaWdQwlB9+XRobxN/gKmLN7Ezpoahu1PEtNBUN8iarzqe5qejfFosie/2IkU7
5ikmigmd01LBAlxfIaA/88zeUUE5AMF58QLArr9q/jZHkoQMKloeQqAXPzZp8c2D
9R+CfkgGATM=
=Ty1q
-----END PGP SIGNATURE-----