Debian Package Tracker

general

source: 389-ds-base (main)
version: 1.4.1.6-4
maintainer: Debian FreeIPA Team (archive) (DMD)
uploaders: Timo Aaltonen [DMD]
arch: all any
std-ver: 4.4.0
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 1.3.3.5-4
o-o-sec: 1.3.3.5-4+deb8u6
oldstable: 1.3.5.17-2
stable: 1.4.0.21-1
testing: 1.4.1.6-4
unstable: 1.4.1.6-4

versioned links

1.3.3.5-4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.3.3.5-4+deb8u6: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.3.5.17-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.4.0.21-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.4.1.6-4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

389-ds (1 bugs: 0, 1, 0, 0)
389-ds-base
389-ds-base-dev
389-ds-base-libs
cockpit-389-ds
python3-lib389

action needed

Marked for autoremoval on 19 December: #944150 high

Version 1.4.1.6-4 of 389-ds-base is marked for autoremoval from testing on Thu 19 Dec 2019. It is affected by #944150. The removal of 389-ds-base will also cause the removal of (transitive) reverse dependency: slapi-nis. You should try to prevent the removal by fixing these RC bugs.

Created: 2019-11-12 Last update: 2019-11-18 06:19

A new upstream version is available: 1.4.2.4 high

A new upstream version 1.4.2.4 is available, you should consider packaging it.

Created: 2019-09-21 Last update: 2019-11-18 02:38

4 security issues in buster high

There are 4 open security issues in buster.

3 important issues:

CVE-2019-14824: A flaw was found in the 'deref' plugin of 389-ds-base where it could use the 'search' permission to display attribute values. In some configurations, this could allow an authenticated attacker to view private attributes, such as password hashes.
CVE-2019-3883: In 389-ds-base up to version 1.4.1.2, requests are handled by workers threads. Each sockets will be waited by the worker for at most 'ioblocktimeout' seconds. However this timeout applies only for un-encrypted requests. Connections using SSL/TLS are not taking this timeout into account during reads, and may hang longer.An unauthenticated attacker could repeatedly create hanging LDAP requests to hang all the workers, resulting in a Denial of Service.
CVE-2019-10224:

1 issue skipped by the security teams:

CVE-2016-5416: 389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise Linux Server 6 through 7, and Red Hat Enterprise Linux Workstation 6 through 7 allows remote attackers to read the default Access Control Instructions.

Please fix them.

Created: 2018-12-17 Last update: 2019-11-10 06:20

2 security issues in bullseye high

There are 2 open security issues in bullseye.

2 important issues:

CVE-2019-14824: A flaw was found in the 'deref' plugin of 389-ds-base where it could use the 'search' permission to display attribute values. In some configurations, this could allow an authenticated attacker to view private attributes, such as password hashes.
CVE-2016-5416: 389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise Linux Server 6 through 7, and Red Hat Enterprise Linux Workstation 6 through 7 allows remote attackers to read the default Access Control Instructions.

Please fix them.

Created: 2019-07-07 Last update: 2019-11-10 06:20

2 security issues in sid high

There are 2 open security issues in sid.

2 important issues:

CVE-2019-14824: A flaw was found in the 'deref' plugin of 389-ds-base where it could use the 'search' permission to display attribute values. In some configurations, this could allow an authenticated attacker to view private attributes, such as password hashes.
CVE-2016-5416: 389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise Linux Server 6 through 7, and Red Hat Enterprise Linux Workstation 6 through 7 allows remote attackers to read the default Access Control Instructions.

Please fix them.

Created: 2016-06-18 Last update: 2019-11-10 06:20

4 security issues in jessie high

There are 4 open security issues in jessie.

1 important issue:

CVE-2019-14824: A flaw was found in the 'deref' plugin of 389-ds-base where it could use the 'search' permission to display attribute values. In some configurations, this could allow an authenticated attacker to view private attributes, such as password hashes.

3 issues skipped by the security teams:

CVE-2016-4992: 389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise Linux Server 6 through 7, and Red Hat Enterprise Linux Workstation 6 through 7 allows remote attackers to infer the existence of RDN component objects.
CVE-2016-5405: 389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise Linux Server 6 through 7, and Red Hat Enterprise Linux Workstation 6 through 7 allows remote attackers to obtain user passwords.
CVE-2016-5416: 389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise Linux Server 6 through 7, and Red Hat Enterprise Linux Workstation 6 through 7 allows remote attackers to read the default Access Control Instructions.

Please fix them.

Created: 2015-07-12 Last update: 2019-11-10 06:20

13 security issues in stretch high

There are 13 open security issues in stretch.

12 important issues:

CVE-2018-1089: 389-ds-base before versions 1.4.0.9, 1.3.8.1, 1.3.6.15 did not properly handle long search filters with characters needing escapes, possibly leading to buffer overflows. A remote, unauthenticated attacker could potentially use this flaw to make ns-slapd crash via a specially crafted LDAP request, thus resulting in denial of service.
CVE-2017-7551: 389-ds-base version before 1.3.5.19 and 1.3.6.7 are vulnerable to password brute-force attacks during account lockout due to different return codes returned on password attempts.
CVE-2018-10850: 389-ds-base before versions 1.4.0.10, 1.3.8.3 is vulnerable to a race condition in the way 389-ds-base handles persistent search, resulting in a crash if the server is under load. An anonymous attacker could use this flaw to trigger a denial of service.
CVE-2018-14638: A flaw was found in 389-ds-base before version 1.3.8.4-13. The process ns-slapd crashes in delete_passwdPolicy function when persistent search connections are terminated unexpectedly leading to remote denial of service.
CVE-2019-14824: A flaw was found in the 'deref' plugin of 389-ds-base where it could use the 'search' permission to display attribute values. In some configurations, this could allow an authenticated attacker to view private attributes, such as password hashes.
CVE-2018-10871: 389-ds-base before versions 1.3.8.5, 1.4.0.12 is vulnerable to a Cleartext Storage of Sensitive Information. By default, when the Replica and/or retroChangeLog plugins are enabled, 389-ds-base stores passwords in plaintext format in their respective changelog files. An attacker with sufficiently high privileges, such as root or Directory Manager, can query these files in order to retrieve plaintext passwords.
CVE-2018-1054: An out-of-bounds memory read flaw was found in the way 389-ds-base handled certain LDAP search filters, affecting all versions including 1.4.x. A remote, unauthenticated attacker could potentially use this flaw to make ns-slapd crash via a specially crafted LDAP request, thus resulting in denial of service.
CVE-2019-3883: In 389-ds-base up to version 1.4.1.2, requests are handled by workers threads. Each sockets will be waited by the worker for at most 'ioblocktimeout' seconds. However this timeout applies only for un-encrypted requests. Connections using SSL/TLS are not taking this timeout into account during reads, and may hang longer.An unauthenticated attacker could repeatedly create hanging LDAP requests to hang all the workers, resulting in a Denial of Service.
CVE-2017-15134: A stack buffer overflow flaw was found in the way 389-ds-base 1.3.6.x before 1.3.6.13, 1.3.7.x before 1.3.7.9, 1.4.x before 1.4.0.5 handled certain LDAP search filters. A remote, unauthenticated attacker could potentially use this flaw to make ns-slapd crash via a specially crafted LDAP request, thus resulting in denial of service.
CVE-2018-14648: A flaw was found in 389 Directory Server. A specially crafted search query could lead to excessive CPU consumption in the do_search() function. An unauthenticated attacker could use this flaw to provoke a denial of service.
CVE-2018-14624: A vulnerability was discovered in 389-ds-base through versions 1.3.7.10, 1.3.8.8 and 1.4.0.16. The lock controlling the error log was not correctly used when re-opening the log file in log__error_emergency(). An attacker could send a flood of modifications to a very large DN, which would cause slapd to crash.
CVE-2018-10935: A flaw was found in the 389 Directory Server that allows users to cause a crash in the LDAP server using ldapsearch with server side sort.

1 issue skipped by the security teams:

CVE-2016-5416: 389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise Linux Server 6 through 7, and Red Hat Enterprise Linux Workstation 6 through 7 allows remote attackers to read the default Access Control Instructions.

Please fix them.

Created: 2016-06-18 Last update: 2019-11-10 06:20

lintian reports 1 error and 9 warnings high

Lintian reports 1 error and 9 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2019-01-12 Last update: 2019-10-15 01:11

Build log checks report 1 warning low

Build log checks report 1 warning

Created: 2017-10-26 Last update: 2018-12-04 00:57

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.4.1 instead of 4.4.0).

Created: 2019-09-29 Last update: 2019-09-29 23:40

testing migrations

This package will soon be part of the auto-icu transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
This package is part of the ongoing testing transition known as python3.8. Please avoid uploads unrelated to this transition, they would likely delay it and require supplementary work from the release managers. On the other hand, if your package has problems preventing it to migrate to testing, please fix them as soon as possible. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.

news

[rss feed]

[2019-09-19] 389-ds-base 1.4.1.6-4 MIGRATED to testing (Debian testing watch)
[2019-09-16] Accepted 389-ds-base 1.4.1.6-4 (source) into unstable (Timo Aaltonen)
[2019-09-13] Accepted 389-ds-base 1.4.1.6-3 (source) into unstable (Timo Aaltonen)
[2019-09-12] Accepted 389-ds-base 1.4.1.6-2 (source) into unstable (Timo Aaltonen)
[2019-09-11] Accepted 389-ds-base 1.4.1.6-1 (source) into unstable (Timo Aaltonen)
[2019-09-06] 389-ds-base 1.4.1.5-1 MIGRATED to testing (Debian testing watch)
[2019-07-10] Accepted 389-ds-base 1.4.1.5-1 (source) into unstable (Timo Aaltonen)
[2019-07-09] 389-ds-base 1.4.0.22-1 MIGRATED to testing (Debian testing watch)
[2019-05-06] Accepted 389-ds-base 1.3.3.5-4+deb8u6 (source all amd64) into oldstable (Mike Gabriel)
[2019-04-24] Accepted 389-ds-base 1.4.0.22-1 (source) into unstable (Timo Aaltonen)
[2019-02-24] 389-ds-base 1.4.0.21-1 MIGRATED to testing (Debian testing watch)
[2019-02-12] Accepted 389-ds-base 1.4.0.21-1 (source) into unstable (Timo Aaltonen)
[2019-01-18] 389-ds-base 1.4.0.20-3 MIGRATED to testing (Debian testing watch)
[2019-01-16] Accepted 389-ds-base 1.4.0.20-3 (source) into unstable (Timo Aaltonen)
[2019-01-14] Accepted 389-ds-base 1.4.0.20-2 (source) into unstable (Timo Aaltonen)
[2019-01-14] Removed 1.4.0.19-3 from unstable (Debian FTP Masters)
[2019-01-14] Removed 1.4.0.18-1 from unstable (Debian FTP Masters)
[2019-01-14] Removed 1.3.4.9-1 from unstable (Debian FTP Masters)
[2019-01-14] Accepted 389-ds-base 1.4.0.20-1 (source amd64 all) into experimental, experimental (Timo Aaltonen)
[2019-01-04] 389-ds-base 1.4.0.19-3 MIGRATED to testing (Debian testing watch)
[2019-01-02] Accepted 389-ds-base 1.4.0.19-3 (source) into unstable (Timo Aaltonen)
[2018-12-17] 389-ds-base 1.4.0.19-2 MIGRATED to testing (Debian testing watch)
[2018-12-05] Accepted 389-ds-base 1.4.0.19-2 (source) into unstable (Timo Aaltonen)
[2018-12-03] Accepted 389-ds-base 1.4.0.19-1 (source) into unstable (Timo Aaltonen)
[2018-10-25] Accepted 389-ds-base 1.3.3.5-4+deb8u5 (source all amd64) into oldstable (Hugo Lefeuvre)
[2018-10-25] Accepted 389-ds-base 1.3.3.5-4+deb8u4 (source all amd64) into oldstable (Hugo Lefeuvre)
[2018-10-10] Accepted 389-ds-base 1.4.0.18-1 (source) into unstable (Timo Aaltonen)
[2018-09-29] Accepted 389-ds-base 1.3.3.5-4+deb8u3 (source all amd64) into oldstable (Hugo Lefeuvre)
[2018-09-27] Accepted 389-ds-base 1.4.0.16-1 (source) into unstable (Timo Aaltonen)
[2018-08-30] Accepted 389-ds-base 1.3.3.5-4+deb8u2 (source all amd64) into oldstable (Mike Gabriel)

bugs [bug history graph]

all: 3
RC: 1
I&N: 2
M&W: 0
F&P: 0
patch: 0

links

homepage
lintian (1, 9)
buildd: logs, checks, clang, reproducibility, cross
popcon
browse source code
edit tags
security tracker
screenshots
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1.4.1.6-4build1
5 bugs