MGASA-2022-0134

Dashboard / Vulnerabilities / MGASA-2022-0134

MGASA-2022-0134

Summary: Updated 389-ds-base packages fix security vulnerability

Details: A vulnerability was discovered in the 389 Directory Server that allows an unauthenticated attacker with network access to the LDAP port to cause a denial of service. The denial of service is triggered by a single message sent over a TCP connection, no bind or other authentication is required. The message triggers a segmentation fault that results in slapd crashing. (CVE-2022-0918) A vulnerability was found in the 389 Directory Server that allows expired passwords to access the database to cause improper authentication. (CVE-2022-0996)

References: https://advisories.mageia.org/MGASA-2022-0134.html, https://bugs.mageia.org/show_bug.cgi?id=30235, https://lists.fedoraproject.org/archives/list/[email protected]/thread/PYT2IQJFHQWZENJJRY6EJB3XIFZGNT7F/, https://lists.opensuse.org/archives/list/[email protected]/thread/WUT5CGHERM6PDXKCM7Z3IJLGIYJ6V6AO/