Debian Long Term Support / LTS Security Information / 2018 / Security Information -- DLA-1483-1 389-ds-base

Debian Security Advisory

DLA-1483-1 389-ds-base -- LTS security update

Date Reported:

30 Aug 2018

Affected Packages:

389-ds-base

Vulnerable:

Yes

Security database references:

In the Debian bugtracking system: Bug 906985.
In Mitre's CVE dictionary: CVE-2018-10871, CVE-2018-10935.

More information:

• CVE-2018-10871

  By default nsslapd-unhashed-pw-switch was set to on. So a copy of the unhashed password was kept in modifiers and was possibly logged in changelog and retroCL.

  Unless it is used by some plugin it does not require to keep unhashed passwords. The nsslapd-unhashed-pw-switch option is now off by default.

• CVE-2018-10935

  It was discovered that any authenticated user doing a search using ldapsearch with extended controls for server side sorting could bring down the LDAP server itself.

  The fix is to check if we are able to index the provided value. If we are not, then slapd_qsort returns an error (LDAP_OPERATION_ERROR).

For Debian 8 Jessie, these problems have been fixed in version 1.3.3.5-4+deb8u2.

We recommend that you upgrade your 389-ds-base packages.

Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS