The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:2595 advisory.

    389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the     Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

    Security Fix(es):

    * 389-ds-base: sync_repl NULL pointer dereference in sync_create_state_control() (CVE-2021-3514)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * ACIs are being evaluated against the Replication Manager account in a replication context. (BZ#1968588)

    * A connection can be erroneously flagged as replication conn during evaluation of an aci with ip bind     rule (BZ#1970791)

    * Large updates can reset the CLcache to the beginning of the changelog (BZ#1972721)

    * Changelog cache can upload updates from a wrong starting point (CSN) (BZ#1972738)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:2595 advisory.

  - 389-ds-base: sync_repl NULL pointer dereference in sync_create_state_control() (CVE-2021-3514)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2021:2595 advisory.

  - When using a sync_repl client in 389-ds-base, an authenticated attacker can cause a NULL pointer     dereference using a specially crafted query, causing a crash. (CVE-2021-3514)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5231-1 advisory.

    It was discovered that 389 Directory Server presented to users, during authentication, an error message     which could be used to discover if a certain LDAP DN existed or not. A remote unauthenticated attacker     could possibly use this to check the existence of an entry in a LDAP database and expose sensitive     information. This issue affected only Ubuntu 20.04 ESM. (CVE-2020-35518)

    It was discovered that 389 Directory Server was incorrectly validating data used to access memory     addresses. An authenticated attacker using a Syncrepl client could use this issue with a specially crafted     query to cause 389 Directory Server to crash, resulting in a denial of service. (CVE-2021-3514)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2021:1878-1 advisory.

  - When using a sync_repl client in 389-ds-base, an authenticated attacker can cause a NULL pointer     dereference using a specially crafted query, causing a crash. (CVE-2021-3514)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-2595 advisory.

    [1.4.3.16-16]
    - Bump version to 1.4.3.16-16
    - Resolves: Bug 1972738 - Changelog cache can upload updates from a wrong starting point (CSN)
    - Resolves: Bug 1972721 - Large updates can reset the CLcache to the beginning of the changelog

    [1.4.3.16-15]
    - Bump version to 1.4.3.16-15
    - Resolves: Bug 1970791 - A connection can be erroneously flagged as replication conn during evaluation of     an aci with ip bind rule

    [1.4.3.16-14]
    - Bump version to 1.4.3.16-14
    - Resolves: Bug 1968588 - ACIs are being evaluated against the Replication Manager account in a     replication context
    - Resolves: Bug 1960720 - sync_repl NULL pointer dereference in sync_create_state_control()

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for 389-ds fixes the following issues :

  - CVE-2021-3514: Fixed a sync_repl NULL pointer     dereference in sync_create_state_control() (bsc#1185356)

389-ds was updated to version 1.4.3.23~git0.f53d0132b :

Bump version to 1.4.3.23 :

  - Issue 4725 - [RFE] DS - Update the password policy to     support a Temporary Password Rules (#4727)

  - Issue 4759 - Fix coverity issue (#4760)

  - Issue 4656 - Fix cherry pick error around replication     enabling

  - Issue 4701 - RFE - Exclude attributes from retro     changelog (#4723) (#4746)

  - Issue 4742 - UI - should always use LDAPI path when     calling CLI

  - Issue 4667 - incorrect accounting of readers in vattr     rwlock (#4732)

  - Issue 4711 - SIGSEV with sync_repl (#4738)

  - Issue 4649 - fix testcase importing ContentSyncPlugin

  - Issue 2736 - Warnings from automatic shebang munging     macro

  - Issue 2736 -     https://github.com/389ds/389-ds-base/issues/2736

  - Issue 4706 - negative wtime in access log for CMP     operations

Bump version to 1.4.3.22 :

  - Issue 4671 - UI - Fix browser crashes

  - lib389 - Add ContentSyncPlugin class

  - Issue 4656 - lib389 - fix cherry pick error

  - Issue 4229 - Fix Rust linking

  - Issue 4658 - monitor - connection start date is     incorrect

  - Issue 2621 - lib389 - backport     ds_supports_new_changelog()

  - Issue 4656 - Make replication CLI backwards compatible     with role name change

  - Issue 4656 - Remove problematic language from     UI/CLI/lib389

  - Issue 4459 - lib389 - Default paths should use dse.ldif     if the server is down

  - Issue 4663 - CLI - unable to add objectclass/attribute     without x-origin

Bump version to 1.4.3.21 :

  - Issue 4169 - UI - updates on the tuning page are not     reflected in the UI

  - Issue 4588 - BUG - unable to compile without xcrypt     (#4589)

  - Issue 4513 - Fix replication CI test failures (#4557)

  - Issue 4646 - CLI/UI - revise DNA plugin management

  - Issue 4644 - Large updates can reset the CLcache to the     beginning of the changelog (#4647)

  - Issue 4649 - crash in sync_repl when a MODRDN create a     cenotaph (#4652)

  - Issue 4615 - log message when psearch first exceeds max     threads per conn

Bump version to 1.4.3.20 :

  - Issue 4324 - Some architectures the cache line size file     does not exist

  - Issue 4593 - RFE - Print help when nsSSLPersonalitySSL     is not found (#4614)

This update was imported from the SUSE:SLE-15-SP2:Update update project.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4021 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4021-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Andrej Shadura     January 19, 2025                              https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : 389-ds-base     Version        : 1.4.4.11-2+deb11u1     CVE ID         : CVE-2021-3652 CVE-2021-4091 CVE-2022-0918 CVE-2022-0996                      CVE-2022-2850 CVE-2024-2199 CVE-2024-3657 CVE-2024-5953                      CVE-2024-8445

    This update fixes multiple vulnerabilities in 389-ds-base LDAP server.

    CVE-2021-3652

        If an asterisk is imported as password hashes, either accidentally         or maliciously, then instead of being inactive, any password will         successfully match during authentication. This flaw allows an attacker         to successfully authenticate as a user whose password was disabled.

    CVE-2021-4091

        A double-free was found in the way 389-ds-base handles virtual         attributes context in persistent searches. An attacker could send a         series of search requests, forcing the server to behave unexpectedly,         and crash.

    CVE-2022-0918

        A vulnerability allows an unauthenticated attacker with network         access to the LDAP port to cause a denial of service. The denial of         service is triggered by a single message sent over a TCP connection,         no bind or other authentication is required. The message triggers         a segmentation fault that results in slapd crashing.

    CVE-2022-0996

        A vulnerability allows expired passwords to access the database to         cause improper authentication.

    CVE-2022-2850

        When the content synchronization plugin is enabled, an authenticated         user can reach a NULL pointer dereference using a specially         crafted query. This flaw allows an authenticated attacker to cause         a denial of service. This CVE is assigned against an incomplete fix         of CVE-2021-3514.

    CVE-2024-2199

        A denial of service vulnerability that may allow an authenticated         user to cause a server crash while modifying `userPassword` using         malformed input.

    CVE-2024-3657

        A specially-crafted LDAP query can potentially cause a failure on         the directory server, leading to a denial of service.

    CVE-2024-5953

        This issue may allow an authenticated user to cause a server denial         of service while attempting to log in with a user with a malformed         hash in their password.

    CVE-2024-8445

        The fix for CVE-2024-2199 in 389-ds-base was insufficient to cover         all scenarios. In certain product versions, an authenticated user         may cause a server crash while modifying `userPassword` using         malformed input.

    For Debian 11 bullseye, these problems have been fixed in version     1.4.4.11-2+deb11u1.

    We recommend that you upgrade your 389-ds-base packages.

    For the detailed security status of 389-ds-base please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/389-ds-base

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3399 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3399-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                         Anton Gladky     April 24, 2023                                https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : 389-ds-base     Version        : 1.4.0.21-1+deb10u1     CVE ID         : CVE-2019-3883 CVE-2019-10224 CVE-2019-14824 CVE-2021-3514                      CVE-2021-3652 CVE-2021-4091 CVE-2022-0918 CVE-2022-0996                      CVE-2022-2850

    Multiple security issues were discovered in 389-ds-base: an open source LDAP     server for Linux.

    CVE-2019-3883

        SSL/TLS requests do not enforce ioblocktimeout limit, leading to DoS         vulnerability by hanging all workers with hanging LDAP requests.

    CVE-2019-10224

        The vulnerability may disclose sensitive information, such as the Directory         Manager password, when the dscreate and dsconf commands are executed in         verbose mode. An attacker who can view the screen or capture the terminal         standard error output can exploit thisvulnerability to obtain confidential information.

    CVE-2019-14824

        The 'deref' plugin of 389-ds-base has a vulnerability that enables it to         disclose attribute values using the 'search' permission. In certain setups,         an authenticated attacker can exploit this flaw to access confidential         attributes, including password hashes.

    CVE-2021-3514

        If a sync_repl client is used, an authenticated attacker can trigger a crash         by exploiting a specially crafted query that leads to a NULL pointer         dereference.

    CVE-2021-3652

        Importing an asterisk as password hashes enables successful authentication         with any password, allowing attackers to access accounts with disabled         passwords.

    CVE-2021-4091

        A double free was found in the way 389-ds-base handles virtual attributes         context in persistent searches. An attacker could send a series of search         requests, forcing the server to behave unexpectedly, and crash.

    CVE-2022-0918

        An unauthenticated attacker with network access to the LDAP port can cause a         denial of service. The denial of service is triggered by a single message         sent over a TCP connection, no bind or other authentication is required. The         message triggers a segmentation fault that results in slapd crashing.

    CVE-2022-0996

        Expired password was still allowed to access the database. A user whose         password was expired was still allowed to access the database as if the         password was not expired.  Once a password is expired, and grace logins         have been used up, the account is basically supposed to be locked out and         should not be allowed to perform any privileged action.

    CVE-2022-2850

        The vulnerability in content synchronization plugin enables an authenticated attacker to trigger a     denial of service via a crafted query through a NULL         pointer dereference.

    For Debian 10 buster, these problems have been fixed in version     1.4.0.21-1+deb10u1.

    We recommend that you upgrade your 389-ds-base packages.

    For the detailed security status of 389-ds-base please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/389-ds-base

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:2796 advisory.

    389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the     Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

    Security Fix(es):

    * 389-ds-base: sync_repl NULL pointer dereference in sync_create_state_control() (CVE-2021-3514)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0952 advisory.

    Red Hat Directory Server is an LDAPv3-compliant directory server. The suite of     packages includes the Lightweight Directory Access Protocol (LDAP) server, as     well as command-line utilities and Web UI packages for server administration.

    Security Fix(es):

    * 389-ds-base: sync_repl NULL pointer dereference in sync_create_state_control() (CVE-2021-3514)

    * 389-ds-base: double-free of the virtual attribute context in persistent search (CVE-2021-4091)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * ACIs are being evaluated against the Replication Manager account in a replication context. (BZ#2022086)

    * A connection can be erroneously flagged as replication conn during evaluation of an aci with ip bind     rule (BZ#2022090)

    * DB corruption _entryrdn_insert_key - Same DN (dn: nsuniqueid=ffffffff-ffffffff-ffffffff-     ffffffff,<SUFFIX>) is already in the entryrdn file (BZ#2022686)

    * CLI needs option to set nsslapd-state (BZ#2040794)

    Users of Red Hat Directory Server 11 are advised to install these updated     packages.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:3955 advisory.

    Red Hat Directory Server is an LDAPv3-compliant directory server. The suite of packages includes the     Lightweight Directory Access Protocol (LDAP) server, as well as command-line utilities and Web UI packages     for server administration.

    This release provides a number of security fixes, bug fixes and enhancements. For detailed information on     changes in this release, see the Red Hat Directory Server 11 Release Notes linked from the References     section.

    Security Fix(es):

    * 389-ds-base: CRYPT password hash with asterisk allows any bind attempt to succeed (CVE-2021-3652)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Users of Red Hat Directory Server 11 are advised to upgrade to these updated packages.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
151153	RHEL 8 : 389-ds:1.4 (RHSA-2021:2595)	Nessus	Red Hat Local Security Checks	6/30/2021	11/7/2024	medium
151366	CentOS 8 : 389-ds:1.4 (CESA-2021:2595)	Nessus	CentOS Local Security Checks	7/3/2021	7/3/2021	medium
157763	Rocky Linux 8 : 389-ds:1.4 (RLSA-2021:2595)	Nessus	Rocky Linux Local Security Checks	2/9/2022	11/7/2023	medium
183133	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM : 389 Directory Server vulnerabilities (USN-5231-1)	Nessus	Ubuntu Local Security Checks	10/16/2023	8/27/2024	medium
150400	SUSE SLES15 Security Update : 389-ds (SUSE-SU-2021:1878-1)	Nessus	SuSE Local Security Checks	6/9/2021	7/13/2023	medium
151353	Oracle Linux 8 : 389-ds:1.4 (ELSA-2021-2595)	Nessus	Oracle Linux Local Security Checks	7/2/2021	11/2/2024	medium
150754	openSUSE Security Update : 389-ds (openSUSE-2021-868)	Nessus	SuSE Local Security Checks	6/14/2021	12/13/2023	medium
214393	Debian dla-4021 : 389-ds - security update	Nessus	Debian Local Security Checks	1/20/2025	1/20/2025	medium
174722	Debian dla-3399 : 389-ds - security update	Nessus	Debian Local Security Checks	4/25/2023	1/22/2025	medium
151849	RHEL 8 : 389-ds:1.4 (RHSA-2021:2796)	Nessus	Red Hat Local Security Checks	7/21/2021	11/8/2024	medium
194281	RHEL 8 : redhat-ds:11.3 (RHSA-2022:0952)	Nessus	Red Hat Local Security Checks	4/28/2024	11/7/2024	high
194190	RHEL 8 : redhat-ds:11 (RHSA-2021:3955)	Nessus	Red Hat Local Security Checks	4/28/2024	11/7/2024	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

high

medium