Incorrect authorization in 389-ds-base - CVE-2022-1949

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU64440

Incorrect authorization in 389-ds-base - CVE-2022-1949

Published: June 16, 2022 / Updated: June 16, 2022


Vulnerability identifier: #VU64440
CSH Severity: Medium
CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-1949
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to incorrect authorization in the 389-ds-base package where some LDAP queries can cause performance issues. A remote attacker can send a non-optimal search that causes serious performance issues within the directory server.


Affected software

389-ds-base
SUSE CaaS Platform
SUSE Manager Server
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Enterprise Storage
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Module for Server Applications
openSUSE Leap
openEuler
389-ds
389-ds-debuginfo
389-ds-debugsource
389-ds-devel
libsvrcore0
libsvrcore0-debuginfo
lib389
389-ds-snmp-debuginfo
389-ds-snmp
389-ds-base-legacy-tools
389-ds-base-help
389-ds-base-devel
389-ds-base-debugsource
389-ds-base-debuginfo
389-ds-base
389-ds-base-snmp
cockpit-389-ds
python3-lib389

How to mitigate CVE-2022-1949

Install updates from vendor's website.

389-ds-base - update to 2.0.0
389-ds - addressed in versions 1.4.0.31~git15.8b9843b0b-150000.4.27.1, 1.4.2.16~git68.efa843752-150100.7.34.1, 1.4.3.30~git2.ca761af4b-150200.3.29.1, 1.4.4.19~git38.9951c1101-150300.3.17.1, 2.0.15~git26.1ea6a6803-150400.3.5.1
389-ds-debuginfo - addressed in versions 1.4.0.31~git15.8b9843b0b-150000.4.27.1, 1.4.2.16~git68.efa843752-150100.7.34.1, 1.4.3.30~git2.ca761af4b-150200.3.29.1, 1.4.4.19~git38.9951c1101-150300.3.17.1, 2.0.15~git26.1ea6a6803-150400.3.5.1
389-ds-debugsource - addressed in versions 1.4.0.31~git15.8b9843b0b-150000.4.27.1, 1.4.2.16~git68.efa843752-150100.7.34.1, 1.4.3.30~git2.ca761af4b-150200.3.29.1, 1.4.4.19~git38.9951c1101-150300.3.17.1, 2.0.15~git26.1ea6a6803-150400.3.5.1
389-ds-devel - addressed in versions 1.4.0.31~git15.8b9843b0b-150000.4.27.1, 1.4.2.16~git68.efa843752-150100.7.34.1, 1.4.3.30~git2.ca761af4b-150200.3.29.1, 1.4.4.19~git38.9951c1101-150300.3.17.1, 2.0.15~git26.1ea6a6803-150400.3.5.1
libsvrcore0 - addressed in versions 1.4.0.31~git15.8b9843b0b-150000.4.27.1, 1.4.2.16~git68.efa843752-150100.7.34.1, 1.4.3.30~git2.ca761af4b-150200.3.29.1, 1.4.4.19~git38.9951c1101-150300.3.17.1, 2.0.15~git26.1ea6a6803-150400.3.5.1
libsvrcore0-debuginfo - addressed in versions 1.4.0.31~git15.8b9843b0b-150000.4.27.1, 1.4.2.16~git68.efa843752-150100.7.34.1, 1.4.3.30~git2.ca761af4b-150200.3.29.1, 1.4.4.19~git38.9951c1101-150300.3.17.1, 2.0.15~git26.1ea6a6803-150400.3.5.1
lib389 - addressed in versions 1.4.2.16~git68.efa843752-150100.7.34.1, 1.4.3.30~git2.ca761af4b-150200.3.29.1, 1.4.4.19~git38.9951c1101-150300.3.17.1, 2.0.15~git26.1ea6a6803-150400.3.5.1
389-ds-snmp-debuginfo - addressed in versions 1.4.2.16~git68.efa843752-150100.7.34.1, 1.4.4.19~git38.9951c1101-150300.3.17.1, 2.0.15~git26.1ea6a6803-150400.3.5.1
389-ds-snmp - addressed in versions 1.4.2.16~git68.efa843752-150100.7.34.1, 1.4.4.19~git38.9951c1101-150300.3.17.1, 2.0.15~git26.1ea6a6803-150400.3.5.1
389-ds-base-legacy-tools - addressed in versions 1.4.3.36-6, 1.4.3.36-7
389-ds-base-help - addressed in versions 1.4.3.36-6, 1.4.3.36-7
389-ds-base-devel - addressed in versions 1.4.3.36-6, 1.4.3.36-7
389-ds-base-debugsource - addressed in versions 1.4.3.36-6, 1.4.3.36-7
389-ds-base-debuginfo - addressed in versions 1.4.3.36-6, 1.4.3.36-7
389-ds-base - addressed in versions 1.4.3.36-6, 1.4.3.36-7
389-ds-base-snmp - addressed in versions 1.4.3.36-6, 1.4.3.36-7
cockpit-389-ds - addressed in versions 1.4.3.36-6, 1.4.3.36-7
python3-lib389 - addressed in versions 1.4.3.36-6, 1.4.3.36-7

External References

Related Security Bulletins