Red Hat Directory Server 11.0

An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would yield incorrect results, but as that has progressed, can be determined that it actually is an access control bypass. This may allow any remote unauthenticated user to issue a filter that allows searching for database items they do not have access to, including but not limited to potentially userPassword hashes and other sensitive data.

389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica id parsing

389-ds-base: 389-ds-base: unbounded ldap controls count in get_ldapmessage_controls_ext() causes cpu and heap amplification (remote dos)

389-ds-base: 389-ds-base: null pointer dereference in deref control plugin ber parser

389-ds-base: 389-ds-base: pre-auth ldap filter injection in cleanallruv status check

A flaw was found In 389-ds-base. When the Content Synchronization plugin is enabled, an authenticated user can reach a NULL pointer dereference using a specially crafted query. This flaw allows an authenticated attacker to cause a denial of service. This CVE is assigned against an incomplete fix of CVE-2021-3514.

389-ds-base: 389-ds-base: smd5 password storage plugin salt length integer underflow crash

389-ds-base: 389-ds-base: content sync plugin unbounded queue growth and race conditions

389-ds-base: 389-ds-base: heap out-of-bounds read in ldif parser str2entry_state_information_from_type()

389-ds-base: 389-ds-base: heap buffer over-read in ldap_utf8prev() via str2simple filter parsing

389-ds-base: 389-ds-base: heap-buffer-overflows in __aclp__normalize_acltxt()

389-ds-base: 389-ds-base: sasl plain bind installs connection credentials before account-lock check, allowing continued access as a locked account

When binding against a DN during authentication, the reply from 389-ds-base will be different whether the DN exists or not. This can be used by an unauthenticated attacker to check the existence of an entry in the LDAP database.

389-ds-base: 389-ds-base: heap-buffer-overflow in dn normalization via quoted multivalued rdn

389-ds-base: 389-ds-base: use-after-free in schema reload via attr_syntax_swap_ht()

389-ds-base: 389-ds-base: pbkdf2 password storage plugin unbounded iteration count denial of service

389-ds-base: 389-ds-base: static initialization vector in aes-cbc/3des-cbc attribute encryption

389-ds-base: 389-ds-base: non-constant-time comparison in pbkdf2-sha256 password verification