Issued:
2019-11-05
Updated:
2019-11-05

RHSA-2019:3401 - Security Advisory

Synopsis

Important: 389-ds:1.4 security, bug fix, and enhancement update

Type/Severity

Security Advisory: Important

Topic

An update for the 389-ds:1.4 module is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

The following packages have been upgraded to a later upstream version: 389-ds-base (1.4.1.3). (BZ#1712467)

Security Fix(es):

  • 389-ds-base: Read permission check bypass via the deref plugin (CVE-2019-14824)
  • 389-ds-base: replication and the Retro Changelog plugin store plaintext password by default (CVE-2018-10871)
  • 389-ds-base: DoS via hanging secured connections (CVE-2019-3883)
  • 389-ds-base: using dscreate in verbose mode results in information disclosure (CVE-2019-10224)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.1 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 8 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 8 s390x
  • Red Hat Enterprise Linux for Power, little endian 8 ppc64le
  • Red Hat Enterprise Linux for ARM 64 8 aarch64

Fixes

  • BZ - 1591480 - CVE-2018-10871 389-ds-base: replication and the Retro Changelog plugin store plaintext password by default
  • BZ - 1654056 - /usr/lib/systemd/system/dirsrv@.service:40: .include directives are deprecated
  • BZ - 1654059 - CVE-2019-10224 389-ds-base: using dscreate in verbose mode results in information disclosure [rhel-8]
  • BZ - 1677147 - CVE-2019-10224 389-ds-base: using dscreate in verbose mode results in information disclosure
  • BZ - 1678517 - ipa role-mod DatabaseError changing cn
  • BZ - 1693612 - CVE-2019-3883 389-ds-base: DoS via hanging secured connections
  • BZ - 1702024 - Cannot create Directory Server's instances using dscreate
  • BZ - 1706224 - Protocol setting is inconsistent in FIPS mode
  • BZ - 1712467 - Rebase 389-ds-base on RHEL 8.1
  • BZ - 1715675 - Fix potential ipv6 issues
  • BZ - 1717540 - Address covscan warnings
  • BZ - 1720331 - Log the actual base DN when the search fails with "invalid attribute request".
  • BZ - 1725815 - consistency in the replication error codes while setting nsds5replicaid=65535
  • BZ - 1729069 - IPA upgrade fails for latest ipa package when setup in multi master mode
  • BZ - 1739183 - CleanAllRUV task limit not enforced
  • BZ - 1747448 - CVE-2019-14824 389-ds-base: Read permission check bypass via the deref plugin

CVEs

References

Red Hat Enterprise Linux for x86_64 8

SRPM
389-ds-base-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f.src.rpm SHA-256: b6e8cfe6c56672420fde084e7b4988d97b7d334f424be55eccda0b2b9d8265ab
x86_64
389-ds-base-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f.x86_64.rpm SHA-256: 9b96994f00e1332ec2b52d46019e9016361ea8517c553d754a2a8413d4d176a0
389-ds-base-debuginfo-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f.x86_64.rpm SHA-256: da466ae4fc583c6a0d3737ad88b1a7f07a37d3ac684f429f58334f63b4257e6c
389-ds-base-debugsource-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f.x86_64.rpm SHA-256: 65e277057962a904fc09ad3d4f3959be8bc04449512d4bc2924dc9420bd124eb
389-ds-base-devel-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f.x86_64.rpm SHA-256: 897418a584f0eb21e6611c970be1bb4d9a5acb426225896bfd9cbbcaa1a160e2
389-ds-base-legacy-tools-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f.x86_64.rpm SHA-256: 15df13fed96f06567acc065ef80cd5618698c3b5f5872131da8c802d13872c3f
389-ds-base-legacy-tools-debuginfo-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f.x86_64.rpm SHA-256: 3156072760ac14c4adefc5bab28286b9f8ef7166737024349a145f168c8720ce
389-ds-base-libs-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f.x86_64.rpm SHA-256: 9a7b191a7f179049a3dd63a71576971e20bbd7adaf98eaa61ed5fdfffbca19fd
389-ds-base-libs-debuginfo-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f.x86_64.rpm SHA-256: 81763f226b14c2e33f8761aa79ed46f767fc4eb4fa67520555e4b320a55ee3dd
389-ds-base-snmp-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f.x86_64.rpm SHA-256: c764e34e5d2574dba7b32fcdfb0ff4fe08a74b6dacdd36da95bd3090e5b02687
389-ds-base-snmp-debuginfo-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f.x86_64.rpm SHA-256: f87f2114b40902c98b740a962cc8ca9f9c0d833877394229a3bb42f8cdb8999a
python3-lib389-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f.noarch.rpm SHA-256: 894d368166121c7b2e38cd9a99190203af72481716e47df585d29a7644cea245

Red Hat Enterprise Linux for IBM z Systems 8

SRPM
389-ds-base-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f.src.rpm SHA-256: b6e8cfe6c56672420fde084e7b4988d97b7d334f424be55eccda0b2b9d8265ab
s390x
python3-lib389-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f.noarch.rpm SHA-256: 894d368166121c7b2e38cd9a99190203af72481716e47df585d29a7644cea245
389-ds-base-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f.s390x.rpm SHA-256: f21038e6e1aa538b69588fe53d2792dfdbabccf0444e380f96cd6db69c03b7eb
389-ds-base-debuginfo-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f.s390x.rpm SHA-256: 7de2924174e93cf655313ed641716fdbeca47103da2c861211976150ed6dde65
389-ds-base-debugsource-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f.s390x.rpm SHA-256: c5439b849156c0f5726954c717a19a09890423753d7919a7b10c955194f62d2f
389-ds-base-devel-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f.s390x.rpm SHA-256: b83fa631994fdde2f23d9831aea7d208e4de514cb3435b653c12d6485830099f
389-ds-base-legacy-tools-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f.s390x.rpm SHA-256: 5d80d203ad1416f524e3232a6fa98f0532f90d209d8e83dcd76250d7d8df22d8
389-ds-base-legacy-tools-debuginfo-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f.s390x.rpm SHA-256: c8e27227040fb34a0b6061014fabe3824a6bc134a3a348f35776f4ff19e7c50f
389-ds-base-libs-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f.s390x.rpm SHA-256: af26761ba208f33d0df8e7e5b07c6bdd33c3de525217b466dc3557e28f154ca5
389-ds-base-libs-debuginfo-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f.s390x.rpm SHA-256: 12483c9fe251e295157b2eeed68401cf7666f523544914b3769d08b695c4d5cd
389-ds-base-snmp-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f.s390x.rpm SHA-256: 151ea7d2c7ecb452e47af27d029839aabbf38a8e750da2d3fca17ce863424d58
389-ds-base-snmp-debuginfo-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f.s390x.rpm SHA-256: e15e4fd633dd2c282324e504537231360409cf0eecc2f5f0fc9b6318cf3e7d05

Red Hat Enterprise Linux for Power, little endian 8

SRPM
389-ds-base-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f.src.rpm SHA-256: b6e8cfe6c56672420fde084e7b4988d97b7d334f424be55eccda0b2b9d8265ab
ppc64le
python3-lib389-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f.noarch.rpm SHA-256: 894d368166121c7b2e38cd9a99190203af72481716e47df585d29a7644cea245
389-ds-base-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f.ppc64le.rpm SHA-256: fa97512a93728b1f9060875a045330998bb3244034a5f111c635b9ae6b8ce4d8
389-ds-base-debuginfo-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f.ppc64le.rpm SHA-256: 27a362270f4720ab16121a509a9322cf4e7259e24c88649d5a9fd4d5742a72fd
389-ds-base-debugsource-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f.ppc64le.rpm SHA-256: f9c8fc63605ccfaf2dc36044986371abd1d99afb3cd04ac1df297a848c169e88
389-ds-base-devel-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f.ppc64le.rpm SHA-256: 679c86d0b193300fcbe19f5ee297109272d751cc9232770443b357207b40db0f
389-ds-base-legacy-tools-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f.ppc64le.rpm SHA-256: c403e34cd8983fcb684228d6745e108aa6f8362599a901d0d1f6b738ea53f9ca
389-ds-base-legacy-tools-debuginfo-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f.ppc64le.rpm SHA-256: 7f49fc05a5c1d89e9aadb503b102fcf103108266046db9d491e46a28d82ca4e1
389-ds-base-libs-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f.ppc64le.rpm SHA-256: 9cb583d0a47fbd3be80b115a096f249bba7806cb47d654c66388e36b55b2378e
389-ds-base-libs-debuginfo-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f.ppc64le.rpm SHA-256: c30431af77c05ee9dc1b5bbda054673587ce04675ffb6c4137aebb459a59438a
389-ds-base-snmp-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f.ppc64le.rpm SHA-256: 5ae01a6aad8b878f05947e72be5aa51620aa125fc965a71c3adfc3ecd8541ca1
389-ds-base-snmp-debuginfo-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f.ppc64le.rpm SHA-256: 224667491f08ae823a73b0717dfc47825958e4475c494c0f3655f547dd3b34fb

Red Hat Enterprise Linux for ARM 64 8

SRPM
389-ds-base-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f.src.rpm SHA-256: b6e8cfe6c56672420fde084e7b4988d97b7d334f424be55eccda0b2b9d8265ab
aarch64
python3-lib389-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f.noarch.rpm SHA-256: 894d368166121c7b2e38cd9a99190203af72481716e47df585d29a7644cea245
389-ds-base-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f.aarch64.rpm SHA-256: ecc1b6298ef0e3e106154d577241b23d89958af2b274747a94f01622720d1882
389-ds-base-debuginfo-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f.aarch64.rpm SHA-256: 0ed74d44193a728c69f61f27b7f126fbf629212f6302edf52f3dbd4116ff4dde
389-ds-base-debugsource-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f.aarch64.rpm SHA-256: 69ea09f4c28ad85950e42adc37a2e77318a34ca6aeff69a487c65b57de3db761
389-ds-base-devel-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f.aarch64.rpm SHA-256: ffa5e16c1474ea4211db7c4517f20a6e15ba19354ef593d3070421f9384d4f13
389-ds-base-legacy-tools-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f.aarch64.rpm SHA-256: 70b75bbdbfc5ec0d49fc08c6ee0d4c786543eda07bd7637ee7d2fd4ae96505f0
389-ds-base-legacy-tools-debuginfo-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f.aarch64.rpm SHA-256: 0a710127dab92b9180d32349231e515863b37aad4de8da1695df6faee009036f
389-ds-base-libs-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f.aarch64.rpm SHA-256: 5b27c9c8601495033b75089b21673befbbbe08ae25a0865b25a77447e752b69f
389-ds-base-libs-debuginfo-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f.aarch64.rpm SHA-256: 68ddbe9f55a555c75d8d454489bc28e9ed4286bf48aa6a4667a0a564fb7d2f6e
389-ds-base-snmp-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f.aarch64.rpm SHA-256: 83a37c7736eb5b90b4c3b08a57b85c0d47f23bc6feb0d7e0fdb7406c31cade6d
389-ds-base-snmp-debuginfo-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f.aarch64.rpm SHA-256: 039dad7197635f25c3eea2cf315289e77b7ec6f49c8ea33bc3ee577ddcad650c

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.