Security update for 389-ds SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2022:1100-1 Final 1 1 2022-04-04T11:00:19Z current 2022-04-04T11:00:19Z 2022-04-04T11:00:19Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for 389-ds This update for 389-ds fixes the following issues: - CVE-2022-0918: Fixed a potential denial of service via crafted packet (bsc#1197275). - CVE-2022-0996: Fixed a mishandling of password expiry (bsc#1197345). - Resolved LDAP-Support not working with DHCP by adding required schema (bsc#1194068) - Resolved multiple index migration bug (bsc#1194084) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-SLE-15.3-2022-1100 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/WUT5CGHERM6PDXKCM7Z3IJLGIYJ6V6AO/ E-Mail link for openSUSE-SU-2022:1100-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1194068 SUSE Bug 1194068 https://bugzilla.suse.com/1194084 SUSE Bug 1194084 https://bugzilla.suse.com/1197275 SUSE Bug 1197275 https://bugzilla.suse.com/1197345 SUSE Bug 1197345 https://www.suse.com/security/cve/CVE-2022-0918/ SUSE CVE CVE-2022-0918 page https://www.suse.com/security/cve/CVE-2022-0996/ SUSE CVE CVE-2022-0996 page openSUSE Leap 15.3 389-ds-1.4.4.19~git28.b12c72226-150300.3.12.1 389-ds-devel-1.4.4.19~git28.b12c72226-150300.3.12.1 389-ds-snmp-1.4.4.19~git28.b12c72226-150300.3.12.1 lib389-1.4.4.19~git28.b12c72226-150300.3.12.1 libsvrcore0-1.4.4.19~git28.b12c72226-150300.3.12.1 389-ds-1.4.4.19~git28.b12c72226-150300.3.12.1 as a component of openSUSE Leap 15.3 389-ds-devel-1.4.4.19~git28.b12c72226-150300.3.12.1 as a component of openSUSE Leap 15.3 389-ds-snmp-1.4.4.19~git28.b12c72226-150300.3.12.1 as a component of openSUSE Leap 15.3 lib389-1.4.4.19~git28.b12c72226-150300.3.12.1 as a component of openSUSE Leap 15.3 libsvrcore0-1.4.4.19~git28.b12c72226-150300.3.12.1 as a component of openSUSE Leap 15.3 A vulnerability was discovered in the 389 Directory Server that allows an unauthenticated attacker with network access to the LDAP port to cause a denial of service. The denial of service is triggered by a single message sent over a TCP connection, no bind or other authentication is required. The message triggers a segmentation fault that results in slapd crashing. CVE-2022-0918 openSUSE Leap 15.3:389-ds-1.4.4.19~git28.b12c72226-150300.3.12.1 openSUSE Leap 15.3:389-ds-devel-1.4.4.19~git28.b12c72226-150300.3.12.1 openSUSE Leap 15.3:389-ds-snmp-1.4.4.19~git28.b12c72226-150300.3.12.1 openSUSE Leap 15.3:lib389-1.4.4.19~git28.b12c72226-150300.3.12.1 openSUSE Leap 15.3:libsvrcore0-1.4.4.19~git28.b12c72226-150300.3.12.1 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/WUT5CGHERM6PDXKCM7Z3IJLGIYJ6V6AO/ https://www.suse.com/security/cve/CVE-2022-0918.html CVE-2022-0918 https://bugzilla.suse.com/1197275 SUSE Bug 1197275 A vulnerability was found in the 389 Directory Server that allows expired passwords to access the database to cause improper authentication. CVE-2022-0996 openSUSE Leap 15.3:389-ds-1.4.4.19~git28.b12c72226-150300.3.12.1 openSUSE Leap 15.3:389-ds-devel-1.4.4.19~git28.b12c72226-150300.3.12.1 openSUSE Leap 15.3:389-ds-snmp-1.4.4.19~git28.b12c72226-150300.3.12.1 openSUSE Leap 15.3:lib389-1.4.4.19~git28.b12c72226-150300.3.12.1 openSUSE Leap 15.3:libsvrcore0-1.4.4.19~git28.b12c72226-150300.3.12.1 moderate 4 AV:N/AC:L/Au:S/C:P/I:N/A:N 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/WUT5CGHERM6PDXKCM7Z3IJLGIYJ6V6AO/ https://www.suse.com/security/cve/CVE-2022-0996.html CVE-2022-0996 https://bugzilla.suse.com/1197345 SUSE Bug 1197345