Debian Package Tracker

general

source: 389-ds-base (main)
version: 1.3.7.10-1
maintainer: Debian FreeIPA Team (archive) [DMD]
uploaders: Timo Aaltonen [DMD]
arch: all any
std-ver: 4.1.0
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

oldstable: 1.3.3.5-4
stable: 1.3.5.17-2
testing: 1.3.7.10-1
unstable: 1.3.7.10-1

versioned links

1.3.3.5-4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.3.4.9-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.3.5.17-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.3.7.10-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

389-ds
389-ds-base
389-ds-base-dev
389-ds-base-libs
python3-dirsrvtests
python3-lib389

action needed

A new upstream version is available: 1.4.0.7 high

A new upstream version 1.4.0.7 is available, you should consider packaging it.

Created: 2017-11-21 Last update: 2018-04-19 08:16

1 security issue in sid high

There is 1 open security issue in sid.

1 important issue:

CVE-2016-5416: 389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise Linux Server 6 through 7, and Red Hat Enterprise Linux Workstation 6 through 7 allows remote attackers to read the default Access Control Instructions.

Please fix it.

Created: 2016-06-18 Last update: 2018-03-29 07:56

10 security issues in jessie high

There are 10 open security issues in jessie.

8 important issues:

CVE-2016-5405: 389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise Linux Server 6 through 7, and Red Hat Enterprise Linux Workstation 6 through 7 allows remote attackers to obtain user passwords.
CVE-2017-15134: A stack buffer overflow flaw was found in the way 389-ds-base 1.3.6.x before 1.3.6.13, 1.3.7.x before 1.3.7.9, 1.4.x before 1.4.0.5 handled certain LDAP search filters. A remote, unauthenticated attacker could potentially use this flaw to make ns-slapd crash via a specially crafted LDAP request, thus resulting in denial of service.
CVE-2017-15135: It was found that 389-ds-base since 1.3.6.1 up to and including 1.4.0.3 did not always handle internal hash comparison operations correctly during the authentication process. A remote, unauthenticated attacker could potentially use this flaw to bypass the authentication process under very rare and specific circumstances.
CVE-2015-3230: 389 Directory Server (formerly Fedora Directory Server) before 1.3.3.12 does not enforce the nsSSL3Ciphers preference when creating an sslSocket, which allows remote attackers to have unspecified impact by requesting to use a disabled cipher.
CVE-2015-1854: 389 Directory Server before 1.3.3.10 allows attackers to bypass intended access restrictions and modify directory entries via a crafted ldapmodrdn call.
CVE-2018-1054: An out-of-bounds memory read flaw was found in the way 389-ds-base handled certain LDAP search filters, affecting all versions including 1.4.x. A remote, unauthenticated attacker could potentially use this flaw to make ns-slapd crash via a specially crafted LDAP request, thus resulting in denial of service.
CVE-2017-2668:
CVE-2017-7551: 389-ds-base version before 1.3.5.19 and 1.3.6.7 are vulnerable to password brute-force attacks during account lockout due to different return codes returned on password attempts.

2 issues skipped by the security teams:

CVE-2016-4992: 389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise Linux Server 6 through 7, and Red Hat Enterprise Linux Workstation 6 through 7 allows remote attackers to infer the existence of RDN component objects.
CVE-2016-5416: 389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise Linux Server 6 through 7, and Red Hat Enterprise Linux Workstation 6 through 7 allows remote attackers to read the default Access Control Instructions.

Please fix them.

Created: 2015-07-12 Last update: 2018-03-29 07:56

1 security issue in buster high

There is 1 open security issue in buster.

1 important issue:

CVE-2016-5416: 389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise Linux Server 6 through 7, and Red Hat Enterprise Linux Workstation 6 through 7 allows remote attackers to read the default Access Control Instructions.

Please fix it.

Created: 2018-02-11 Last update: 2018-03-29 07:56

5 security issues in stretch high

There are 5 open security issues in stretch.

4 important issues:

CVE-2018-1054: An out-of-bounds memory read flaw was found in the way 389-ds-base handled certain LDAP search filters, affecting all versions including 1.4.x. A remote, unauthenticated attacker could potentially use this flaw to make ns-slapd crash via a specially crafted LDAP request, thus resulting in denial of service.
CVE-2017-15134: A stack buffer overflow flaw was found in the way 389-ds-base 1.3.6.x before 1.3.6.13, 1.3.7.x before 1.3.7.9, 1.4.x before 1.4.0.5 handled certain LDAP search filters. A remote, unauthenticated attacker could potentially use this flaw to make ns-slapd crash via a specially crafted LDAP request, thus resulting in denial of service.
CVE-2017-7551: 389-ds-base version before 1.3.5.19 and 1.3.6.7 are vulnerable to password brute-force attacks during account lockout due to different return codes returned on password attempts.
CVE-2017-15135: It was found that 389-ds-base since 1.3.6.1 up to and including 1.4.0.3 did not always handle internal hash comparison operations correctly during the authentication process. A remote, unauthenticated attacker could potentially use this flaw to bypass the authentication process under very rare and specific circumstances.

1 issue skipped by the security teams:

CVE-2016-5416: 389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise Linux Server 6 through 7, and Red Hat Enterprise Linux Workstation 6 through 7 allows remote attackers to read the default Access Control Instructions.

Please fix them.

Created: 2016-06-18 Last update: 2018-03-29 07:56

Multiarch hinter reports 2 issue(s) normal

There are issues with the multiarch metadata for this package.

389-ds-base-dev could be marked Multi-Arch: same
389-ds-base-libs could be marked Multi-Arch: same

Created: 2018-03-14 Last update: 2018-04-19 08:31

lintian reports 47 warnings normal

Lintian reports 47 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2018-04-11 Last update: 2018-04-11 06:09

Build log checks report 1 warning low

Build log checks report 1 warning

Created: 2017-10-26 Last update: 2017-10-26 01:26

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.1.4 instead of 4.1.0).

Created: 2017-10-04 Last update: 2018-04-16 20:52

testing migrations

This package will soon be part of the auto-icu transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.

news

[rss feed]

[2018-03-18] 389-ds-base 1.3.7.10-1 MIGRATED to testing (Debian testing watch)
[2018-03-13] Accepted 389-ds-base 1.3.7.10-1 (source) into unstable (Timo Aaltonen)
[2018-02-11] 389-ds-base 1.3.7.9-1 MIGRATED to testing (Debian testing watch)
[2018-02-05] Accepted 389-ds-base 1.3.7.9-1 (source) into unstable (Timo Aaltonen)
[2017-12-21] Accepted 389-ds-base 1.3.7.8-4 (source) into unstable (Timo Aaltonen)
[2017-12-20] Accepted 389-ds-base 1.3.7.8-3 (source) into unstable (Timo Aaltonen)
[2017-12-20] Accepted 389-ds-base 1.3.7.8-2 (source) into unstable (Timo Aaltonen)
[2017-12-13] Accepted 389-ds-base 1.3.7.8-1 (source amd64 all) into unstable, unstable (Timo Aaltonen)
[2017-10-04] Accepted 389-ds-base 1.3.7.5-1 (source) into unstable (Timo Aaltonen)
[2017-09-21] Accepted 389-ds-base 1.3.6.7-5 (source) into unstable (Timo Aaltonen)
[2017-09-12] 389-ds-base REMOVED from testing (Debian testing watch)
[2017-09-04] 389-ds-base 1.3.6.7-4 MIGRATED to testing (Debian testing watch)
[2017-08-29] Accepted 389-ds-base 1.3.6.7-4 (source) into unstable (Timo Aaltonen)
[2017-08-28] Accepted 389-ds-base 1.3.6.7-3 (source) into unstable (Timo Aaltonen)
[2017-08-24] Accepted 389-ds-base 1.3.6.7-2 (source) into unstable (Timo Aaltonen)
[2017-08-22] Accepted 389-ds-base 1.3.6.7-1 (source) into unstable (Timo Aaltonen)
[2017-05-15] 389-ds-base 1.3.5.17-2 MIGRATED to testing (Debian testing watch)
[2017-05-10] Accepted 389-ds-base 1.3.6.5-1 (source) into experimental (Timo Aaltonen)
[2017-05-10] Accepted 389-ds-base 1.3.5.17-2 (source) into unstable (Timo Aaltonen)
[2017-05-09] Accepted 389-ds-base 1.3.5.17-1 (source) into unstable (Timo Aaltonen)
[2017-02-03] 389-ds-base 1.3.5.15-2 MIGRATED to testing (Debian testing watch)
[2017-01-26] Accepted 389-ds-base 1.3.5.15-2 (source) into unstable (Timo Aaltonen)
[2017-01-02] 389-ds-base 1.3.5.15-1 MIGRATED to testing (Debian testing watch)
[2016-12-23] Accepted 389-ds-base 1.3.5.15-1 (source) into unstable (Timo Aaltonen)
[2016-11-02] 389-ds-base 1.3.5.14-1 MIGRATED to testing (Debian testing watch)
[2016-10-27] Accepted 389-ds-base 1.3.5.14-1 (source) into unstable (Timo Aaltonen)
[2016-10-18] 389-ds-base 1.3.5.13-1 MIGRATED to testing (Debian testing watch)
[2016-10-12] Accepted 389-ds-base 1.3.5.13-1 (source) into unstable (Timo Aaltonen)
[2016-10-09] 389-ds-base 1.3.4.14-2 MIGRATED to testing (Debian testing watch)
[2016-10-03] Accepted 389-ds-base 1.3.4.14-2 (source) into unstable (Timo Aaltonen)

bugs [bug history graph]

all: 2
RC: 0
I&N: 2
M&W: 0
F&P: 0

links

homepage
lintian (0, 47)
buildd: logs, checks, clang, reproducibility
popcon
debci
browse source code
edit tags
security tracker
screenshots

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1.3.7.10-1ubuntu1
3 bugs
patches for 1.3.7.10-1ubuntu1