| Summary: | 389-ds-base new security issue CVE-2022-2850 | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | David Walser <luigiwalser> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | Sec team <security> |
| Severity: | major | ||
| Priority: | Normal | CC: | andrewsfarm, davidwhodgins, herman.viaene, nicolas.salguero, sysadmin-bugs |
| Version: | 8 | Keywords: | advisory, validated_update |
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | MGA8-64-OK | ||
| Source RPM: | 389-ds-base-1.4.0.26-15.mga9.src.rpm | CVE: | CVE-2022-2850 |
| Status comment: | |||
|
Description
David Walser
2022-10-25 14:32:04 CEST
David Walser
2022-10-25 14:32:33 CEST
Whiteboard:
(none) =>
MGA8TOO Assigning to NicoalsS who has done several CVE updates to this package. Assignee:
bugsquad =>
nicolas.salguero I added two patches from CentOS 7. For Mageia 8, the build was successful but for Cauldron the build failed when trying to link to library libldap_r, which was removed in version 2.5 of openladp. In Cauldron, it either should be updated to a current version or dropped. It's strange that it depends on openldap given that it's supposed to be a replacement for it. Suggested advisory: ======================== The updated packages fix a security vulnerability: A flaw was found In 389-ds-base. When the Content Synchronization plugin is enabled, an authenticated user can reach a NULL pointer dereference using a specially crafted query. This flaw allows an authenticated attacker to cause a denial of service. This CVE is assigned against an incomplete fix of CVE-2021-3514. (CVE-2022-2850) References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2850 https://access.redhat.com/errata/RHSA-2022:7087 ======================== Updated packages in core/updates_testing: ======================== 389-ds-base-1.4.0.26-8.6.mga8 389-ds-base-snmp-1.4.0.26-8.6.mga8 cockpit-389-ds-1.4.0.26-8.6.mga8 lib(64)389-ds-base0-1.4.0.26-8.6.mga8 lib(64)389-ds-base-devel-1.4.0.26-8.6.mga8 lib(64)svrcore0-1.4.0.26-8.6.mga8 lib(64)svrcore-devel-1.4.0.26-8.6.mga8 from SRPM: 389-ds-base-1.4.0.26-8.6.mga8.src.rpm Status:
NEW =>
ASSIGNED MGA8-64 MATE on Acer Aspire 5253 No installation issues Ref bug 30558 Comment 2, # setup-ds.pl ============================================================================== This program will set up the 389 Directory Server. It is recommended that you have "root" privilege to set up the software. Tips for using this program: - Press "Enter" to choose the default and go to the next screen - Type "Control-B" or the word "back" then "Enter" to go back to the previous screen - Type "Control-C" to cancel the setup program Would you like to continue with set up? [yes]: etc..... All furter results are the same, so I will not repeat the whole list. OK for me. Whiteboard:
(none) =>
MGA8-64-OK Validating. Advisory in Comment 4. CC:
(none) =>
andrewsfarm, sysadmin-bugs
Dave Hodgins
2022-11-08 15:35:15 CET
CC:
(none) =>
davidwhodgins An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2022-0413.html Resolution:
(none) =>
FIXED |