Red Hat Directory Server 12.0

An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would yield incorrect results, but as that has progressed, can be determined that it actually is an access control bypass. This may allow any remote unauthenticated user to issue a filter that allows searching for database items they do not have access to, including but not limited to potentially userPassword hashes and other sensitive data.

389-ds-base: 389-ds-base: unbounded ldap controls count in get_ldapmessage_controls_ext() causes cpu and heap amplification (remote dos)

389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica id parsing

389-ds-base: 389-ds-base: null pointer dereference in deref control plugin ber parser

389-ds-base: 389-ds-base: pre-auth ldap filter injection in cleanallruv status check

A flaw was found In 389-ds-base. When the Content Synchronization plugin is enabled, an authenticated user can reach a NULL pointer dereference using a specially crafted query. This flaw allows an authenticated attacker to cause a denial of service. This CVE is assigned against an incomplete fix of CVE-2021-3514.

389-ds-base: unauthenticated user can trigger a dos by sending a specific extended search request

389-ds-base: 389-ds-base: smd5 password storage plugin salt length integer underflow crash

389-ds-base: 389-ds-base: content sync plugin unbounded queue growth and race conditions

389-ds-base: 389-ds-base: heap out-of-bounds read in ldif parser str2entry_state_information_from_type()

389-ds-base: 389-ds-base: heap buffer over-read in ldap_utf8prev() via str2simple filter parsing

389-ds-base: a heap overflow leading to denail-of-servce while writing a value larger than 256 chars (in log_entry_attr)

A flaw was found in RHDS 11 and RHDS 12. While browsing entries LDAP tries to decode the userPassword attribute instead of the userCertificate attribute which could lead into sensitive information leaked. An attacker with a local account where the cockpit-389-ds is running can list the processes and display the hashed passwords. The highest threat from this vulnerability is to data confidentiality.

389-ds-base: 389-ds-base: sasl plain bind installs connection credentials before account-lock check, allowing continued access as a locked account

389-ds-base: 389-ds-base: heap-buffer-overflows in __aclp__normalize_acltxt()

389-ds-base: 389-ds-base: heap-buffer-overflow in dn normalization via quoted multivalued rdn

389-ds-base: 389-ds-base: use-after-free in schema reload via attr_syntax_swap_ht()

389-ds-base: 389-ds-base: pbkdf2 password storage plugin unbounded iteration count denial of service

389-ds-base: 389-ds-base: static initialization vector in aes-cbc/3des-cbc attribute encryption

389-ds-base: 389-ds-base: partial stack address information leak via ber_printf type confusion in sso token handler

389-ds-base: 389-ds-base: non-constant-time comparison in pbkdf2-sha256 password verification