Arch Linux Security Advisory ASA-202107-72
=========================================
Severity: Medium
Date    : 2021-07-27
CVE-ID  : CVE-2021-3514 CVE-2021-3652
Package : 389-ds-base
Type    : multiple issues
Remote  : Yes
Link    : https://security.archlinux.org/AVG-2206

Summary
======
The package 389-ds-base before version 2.0.7-1 is vulnerable to
multiple issues including authentication bypass and denial of service.

Resolution
=========
Upgrade to 2.0.7-1.

# pacman -Syu "389-ds-base>=2.0.7-1"

The problems have been fixed upstream in version 2.0.7.

Workaround
=========
None.

Description
==========
- CVE-2021-3514 (denial of service)

A security issue was found in 389-ds-base before version 2.0.5. When
using a sync_repl client, an authenticated attacker can cause a NULL
pointer dereference using a specially crafted query, causing a crash of
389-ds-base.

- CVE-2021-3652 (authentication bypass)

In 389-ds-base before version 2.0.7, it was found that if an asterisk
is imported as a password hash, either accidentally or maliciously,
then instead of being inactive, any password will successfully match
during authentication. This would allow an attacker to successfully
authenticate as a user who's password was supposedly disabled.

Impact
=====
An attacker could successfully authenticate as a user who's password
was supposedly disabled. Furthermore, an authenticated attacker could
crash the 389-ds-base server.

References
=========
https://bugzilla.redhat.com/show_bug.cgi?id=1952907
https://github.com/389ds/389-ds-base/issues/4711
https://github.com/389ds/389-ds-base/pull/4738
https://github.com/389ds/389-ds-base/commit/d7eef2fcfbab2ef8aa6ee0bf60f0a9b16ede66e0
https://bugzilla.redhat.com/show_bug.cgi?id=1982782
https://github.com/389ds/389-ds-base/issues/4817
https://github.com/389ds/389-ds-base/pull/4819
https://github.com/389ds/389-ds-base/commit/aeb90eb0c41fc48541d983f323c627b2e6c328c7
https://security.archlinux.org/CVE-2021-3514
https://security.archlinux.org/CVE-2021-3652