RHSA-2021:3955 - Security Advisory

Topic

Red Hat Directory Server 11.4 is now available.

Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat Directory Server is an LDAPv3-compliant directory server. The suite of packages includes the Lightweight Directory Access Protocol (LDAP) server, as well as command-line utilities and Web UI packages for server administration.

This release provides a number of security fixes, bug fixes and enhancements. For detailed information on changes in this release, see the Red Hat Directory Server 11 Release Notes linked from the References section.

Security Fix(es):

• 389-ds-base: CRYPT password hash with asterisk allows any bind attempt to succeed (CVE-2021-3652)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Users of Red Hat Directory Server 11 are advised to upgrade to these updated packages.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Directory Server 11 x86_64

Fixes

• BZ - 1902303 - dsconf LDAPS connection error with msg "certificate verify failed"
• BZ - 1903350 - LDAPS replication and dsconf replication status fails with error "certificate verify failed"
• BZ - 1931820 - ACIs are being evaluated against the Replication Manager account in a replication context.
• BZ - 1947469 - dsconf fails to add a PTA URL due to an invalid check.
• BZ - 1951537 - Import reports "successful" even if entries could not be added and import was incomplete
• BZ - 1955658 - Enabling replication on supplier node using 'dsconf replication enable' command fails with "ERROR: Error: Server is unwilling to perform - Attribute nsDS5ReplicaId value (65535) is invalid, must be a number between 1 and 65534."
• BZ - 1974226 - Errors from certutil are not propagated
• BZ - 1974243 - dsidm instance_name user create is broken in 1.4.3.11
• BZ - 1979612 - RHDS Cockpit: Vertical Page Scrolling Doesn't Work
• BZ - 1981833 - CVE-2021-3652 redhat-ds:11/389-ds-base: CRYPT password hash with asterisk allows any bind attempt to succeed [directory_server_11]
• BZ - 1982782 - CVE-2021-3652 389-ds-base: CRYPT password hash with asterisk allows any bind attempt to succeed

CVEs

• CVE-2021-3514
• CVE-2021-3652

References

• https://access.redhat.com/security/updates/classification/#low
• https://access.redhat.com/documentation/en-us/red_hat_directory_server/11/html/release_notes/