-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: 389-ds:1.4 security update Advisory ID: RHSA-2022:5823-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2022:5823 Issue date: 2022-08-02 CVE Names: CVE-2022-0918 CVE-2022-0996 ==================================================================== 1. Summary: An update for the 389-ds:1.4 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux AppStream (v. 8) - aarch64, noarch, ppc64le, s390x, x86_64 3. Description: 389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration. Security Fix(es): * 389-ds-base: sending crafted message could result in DoS (CVE-2022-0918) * 389-ds-base: expired password was still allowed to access the database (CVE-2022-0996) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 2055815 - CVE-2022-0918 389-ds-base: sending crafted message could result in DoS 2064769 - CVE-2022-0996 389-ds-base: expired password was still allowed to access the database 6. Package List: Red Hat Enterprise Linux AppStream (v. 8): Source: 389-ds-base-1.4.3.28-7.module+el8.6.0+15293+4900ec12.src.rpm aarch64: 389-ds-base-1.4.3.28-7.module+el8.6.0+15293+4900ec12.aarch64.rpm 389-ds-base-debuginfo-1.4.3.28-7.module+el8.6.0+15293+4900ec12.aarch64.rpm 389-ds-base-debugsource-1.4.3.28-7.module+el8.6.0+15293+4900ec12.aarch64.rpm 389-ds-base-devel-1.4.3.28-7.module+el8.6.0+15293+4900ec12.aarch64.rpm 389-ds-base-legacy-tools-1.4.3.28-7.module+el8.6.0+15293+4900ec12.aarch64.rpm 389-ds-base-legacy-tools-debuginfo-1.4.3.28-7.module+el8.6.0+15293+4900ec12.aarch64.rpm 389-ds-base-libs-1.4.3.28-7.module+el8.6.0+15293+4900ec12.aarch64.rpm 389-ds-base-libs-debuginfo-1.4.3.28-7.module+el8.6.0+15293+4900ec12.aarch64.rpm 389-ds-base-snmp-1.4.3.28-7.module+el8.6.0+15293+4900ec12.aarch64.rpm 389-ds-base-snmp-debuginfo-1.4.3.28-7.module+el8.6.0+15293+4900ec12.aarch64.rpm noarch: python3-lib389-1.4.3.28-7.module+el8.6.0+15293+4900ec12.noarch.rpm ppc64le: 389-ds-base-1.4.3.28-7.module+el8.6.0+15293+4900ec12.ppc64le.rpm 389-ds-base-debuginfo-1.4.3.28-7.module+el8.6.0+15293+4900ec12.ppc64le.rpm 389-ds-base-debugsource-1.4.3.28-7.module+el8.6.0+15293+4900ec12.ppc64le.rpm 389-ds-base-devel-1.4.3.28-7.module+el8.6.0+15293+4900ec12.ppc64le.rpm 389-ds-base-legacy-tools-1.4.3.28-7.module+el8.6.0+15293+4900ec12.ppc64le.rpm 389-ds-base-legacy-tools-debuginfo-1.4.3.28-7.module+el8.6.0+15293+4900ec12.ppc64le.rpm 389-ds-base-libs-1.4.3.28-7.module+el8.6.0+15293+4900ec12.ppc64le.rpm 389-ds-base-libs-debuginfo-1.4.3.28-7.module+el8.6.0+15293+4900ec12.ppc64le.rpm 389-ds-base-snmp-1.4.3.28-7.module+el8.6.0+15293+4900ec12.ppc64le.rpm 389-ds-base-snmp-debuginfo-1.4.3.28-7.module+el8.6.0+15293+4900ec12.ppc64le.rpm s390x: 389-ds-base-1.4.3.28-7.module+el8.6.0+15293+4900ec12.s390x.rpm 389-ds-base-debuginfo-1.4.3.28-7.module+el8.6.0+15293+4900ec12.s390x.rpm 389-ds-base-debugsource-1.4.3.28-7.module+el8.6.0+15293+4900ec12.s390x.rpm 389-ds-base-devel-1.4.3.28-7.module+el8.6.0+15293+4900ec12.s390x.rpm 389-ds-base-legacy-tools-1.4.3.28-7.module+el8.6.0+15293+4900ec12.s390x.rpm 389-ds-base-legacy-tools-debuginfo-1.4.3.28-7.module+el8.6.0+15293+4900ec12.s390x.rpm 389-ds-base-libs-1.4.3.28-7.module+el8.6.0+15293+4900ec12.s390x.rpm 389-ds-base-libs-debuginfo-1.4.3.28-7.module+el8.6.0+15293+4900ec12.s390x.rpm 389-ds-base-snmp-1.4.3.28-7.module+el8.6.0+15293+4900ec12.s390x.rpm 389-ds-base-snmp-debuginfo-1.4.3.28-7.module+el8.6.0+15293+4900ec12.s390x.rpm x86_64: 389-ds-base-1.4.3.28-7.module+el8.6.0+15293+4900ec12.x86_64.rpm 389-ds-base-debuginfo-1.4.3.28-7.module+el8.6.0+15293+4900ec12.x86_64.rpm 389-ds-base-debugsource-1.4.3.28-7.module+el8.6.0+15293+4900ec12.x86_64.rpm 389-ds-base-devel-1.4.3.28-7.module+el8.6.0+15293+4900ec12.x86_64.rpm 389-ds-base-legacy-tools-1.4.3.28-7.module+el8.6.0+15293+4900ec12.x86_64.rpm 389-ds-base-legacy-tools-debuginfo-1.4.3.28-7.module+el8.6.0+15293+4900ec12.x86_64.rpm 389-ds-base-libs-1.4.3.28-7.module+el8.6.0+15293+4900ec12.x86_64.rpm 389-ds-base-libs-debuginfo-1.4.3.28-7.module+el8.6.0+15293+4900ec12.x86_64.rpm 389-ds-base-snmp-1.4.3.28-7.module+el8.6.0+15293+4900ec12.x86_64.rpm 389-ds-base-snmp-debuginfo-1.4.3.28-7.module+el8.6.0+15293+4900ec12.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2022-0918 https://access.redhat.com/security/cve/CVE-2022-0996 https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYuqtXdzjgjWX9erEAQjNhhAAgdGFGdpxuDSAfDkauw5x1YCZzWUi03n3 QwmjoYQmScArxrRoD49HiytSOl6Fhqbe2jERomuNoZXxQhhQxdXR2oXVNyo6/aQ1 iv4FqFDfSvCLcnqVeVXX73M58p72qDiR8uM0DSS1AdeIeI7abAWkjGDSnPjE/RHy mYLv1pxyYnivJGA/Bd6L+5rqvBW5KU8UPAUbtVi2Pu2DaaGXtblvfrAUrDQxCubg Z4mikQqsBHR1/xicqrI57K8d9te3gNDZok7G+Ga3BlbOM9LM28wI4nUtZKfJZKiv PB0mMkQtCiVwcI75frAfRgdLCZ1INiUAgqki6PKTq8IN2r4iY9iLpAKPQmUwqV3T GLylAY5fokBz9V7/k6wdvQyPZuXpyHBvPYBOftCr84Mj3bWQQYsyOAe9/SIuuYLb qjqpgYeqdrce0B4FLeQ62vsCjzCRH6wLHnbyLB2d9vYNnNNQqwnLyu9/k7zootLA scu3l9GlX0WNchLK3PG305qsK6lQM5faIt9yd9L0NtGtiWWOBxMZUEUd+Xhpa/+V kqiOfqKOLl1V/WOZUY31HtjjwJuPV16y2D9qovtx36Y3ytITaN1RHU0TOAqoJBf9 /UJpKJEwQsXzNKmJoEI02u2zCU78ixO+Go5qsTZIpib086+BTd4bM/38LiYstH+7 vsjx/B7PR3Y=mraU -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce