Debian Package Tracker

general

source: 389-ds-base (main)
version: 1.4.0.18-1
maintainer: Debian FreeIPA Team [DMD]
uploaders: Timo Aaltonen [DMD]
arch: all any
std-ver: 4.1.0
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

oldstable: 1.3.3.5-4
old-sec: 1.3.3.5-4+deb8u3
stable: 1.3.5.17-2
unstable: 1.4.0.18-1

versioned links

1.3.3.5-4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.3.3.5-4+deb8u3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.3.4.9-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.3.5.17-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.3.8.2-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.4.0.18-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

389-ds
389-ds-base
389-ds-base-dev
389-ds-base-libs
cockpit-389-ds
python3-dirsrvtests
python3-lib389

action needed

lintian reports 46 errors and 44 warnings high

Lintian reports 46 errors and 44 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2018-04-11 Last update: 2018-10-12 08:17

4 security issues in jessie high

There are 4 open security issues in jessie.

1 important issue:

CVE-2018-14648: A flaw was found in 389 Directory Server. A specially crafted search query could lead to excessive CPU consumption in the do_search() function. An unauthenticated attacker could use this flaw to provoke a denial of service.

3 issues skipped by the security teams:

CVE-2016-5416: 389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise Linux Server 6 through 7, and Red Hat Enterprise Linux Workstation 6 through 7 allows remote attackers to read the default Access Control Instructions.
CVE-2016-5405: 389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise Linux Server 6 through 7, and Red Hat Enterprise Linux Workstation 6 through 7 allows remote attackers to obtain user passwords.
CVE-2016-4992: 389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise Linux Server 6 through 7, and Red Hat Enterprise Linux Workstation 6 through 7 allows remote attackers to infer the existence of RDN component objects.

Please fix them.

Created: 2015-07-12 Last update: 2018-10-11 08:01

2 security issues in sid high

There are 2 open security issues in sid.

2 important issues:

CVE-2016-5416: 389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise Linux Server 6 through 7, and Red Hat Enterprise Linux Workstation 6 through 7 allows remote attackers to read the default Access Control Instructions.
CVE-2018-14648: A flaw was found in 389 Directory Server. A specially crafted search query could lead to excessive CPU consumption in the do_search() function. An unauthenticated attacker could use this flaw to provoke a denial of service.

Please fix them.

Created: 2016-06-18 Last update: 2018-10-11 08:01

11 security issues in stretch high

There are 11 open security issues in stretch.

10 important issues:

CVE-2018-10850: 389-ds-base before versions 1.4.0.10, 1.3.8.3 is vulnerable to a race condition in the way 389-ds-base handles persistent search, resulting in a crash if the server is under load. An anonymous attacker could use this flaw to trigger a denial of service.
CVE-2018-1089: 389-ds-base before versions 1.4.0.9, 1.3.8.1, 1.3.6.15 did not properly handle long search filters with characters needing escapes, possibly leading to buffer overflows. A remote, unauthenticated attacker could potentially use this flaw to make ns-slapd crash via a specially crafted LDAP request, thus resulting in denial of service.
CVE-2018-10935: A flaw was found in the 389 Directory Server that allows users to cause a crash in the LDAP server using ldapsearch with server side sort.
CVE-2018-10871: 389-ds-base before versions 1.3.8.5, 1.4.0.12 is vulnerable to a Cleartext Storage of Sensitive Information. By default, when the Replica and/or retroChangeLog plugins are enabled, 389-ds-base stores passwords in plaintext format in their respective changelog files. An attacker with sufficiently high privileges, such as root or Directory Manager, can query these files in order to retrieve plaintext passwords.
CVE-2018-1054: An out-of-bounds memory read flaw was found in the way 389-ds-base handled certain LDAP search filters, affecting all versions including 1.4.x. A remote, unauthenticated attacker could potentially use this flaw to make ns-slapd crash via a specially crafted LDAP request, thus resulting in denial of service.
CVE-2017-7551: 389-ds-base version before 1.3.5.19 and 1.3.6.7 are vulnerable to password brute-force attacks during account lockout due to different return codes returned on password attempts.
CVE-2018-14648: A flaw was found in 389 Directory Server. A specially crafted search query could lead to excessive CPU consumption in the do_search() function. An unauthenticated attacker could use this flaw to provoke a denial of service.
CVE-2017-15134: A stack buffer overflow flaw was found in the way 389-ds-base 1.3.6.x before 1.3.6.13, 1.3.7.x before 1.3.7.9, 1.4.x before 1.4.0.5 handled certain LDAP search filters. A remote, unauthenticated attacker could potentially use this flaw to make ns-slapd crash via a specially crafted LDAP request, thus resulting in denial of service.
CVE-2018-14638: A flaw was found in 389-ds-base before version 1.3.8.4-13. The process ns-slapd crashes in delete_passwdPolicy function when persistent search connections are terminated unexpectedly leading to remote denial of service.
CVE-2018-14624: A vulnerability was discovered in 389-ds-base through versions 1.3.7.10, 1.3.8.8 and 1.4.0.16. The lock controlling the error log was not correctly used when re-opening the log file in log__error_emergency(). An attacker could send a flood of modifications to a very large DN, which would cause slapd to crash.

1 issue skipped by the security teams:

CVE-2016-5416: 389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise Linux Server 6 through 7, and Red Hat Enterprise Linux Workstation 6 through 7 allows remote attackers to read the default Access Control Instructions.

Please fix them.

Created: 2016-06-18 Last update: 2018-10-11 08:01

1 bug tagged patch in the BTS normal

The BTS contains patches fixing 1 bug, consider including or untagging them.

Created: 2018-10-14 Last update: 2018-10-17 16:32

Depends on packages which need a new maintainer normal

The packages that 389-ds-base depends on which need a new maintainer are:

doxygen (#888580)
- Build-Depends: doxygen

Created: 2018-10-12 Last update: 2018-10-17 16:23

The package has not entered testing even though the delay is over normal

The package has not entered testing even though the 2-day delay is over. Check why.

Created: 2018-10-13 Last update: 2018-10-17 16:13

Multiarch hinter reports 1 issue(s) normal

There are issues with the multiarch metadata for this package.

cockpit-389-ds could be marked Multi-Arch: same

Created: 2018-10-11 Last update: 2018-10-17 15:20

1 new commit since last upload, time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 1.4.0.18-2, distribution UNRELEASED) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit ac06ab67db6854adcba14f47e0bf638a12f4e023
Author: Timo Aaltonen <tjaalton@debian.org>
Date:   Thu Oct 11 19:07:32 2018 +0300

    control: Make C/R backports-compatible. (Closes: #910796)

Created: 2018-10-11 Last update: 2018-10-17 14:30

Build log checks report 2 warnings low

Build log checks report 2 warnings

Created: 2017-10-26 Last update: 2018-10-11 04:26

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.2.1 instead of 4.1.0).

Created: 2017-10-04 Last update: 2018-10-11 07:11

testing migrations

This package will soon be part of the auto-icu transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
This package is part of the ongoing testing transition known as python3.7. Please avoid uploads unrelated to this transition, they would likely delay it and require supplementary work from the release managers. On the other hand, if your package has problems preventing it to migrate to testing, please fix them as soon as possible. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
excuses:
- Migrates after: 389-admin, 389-admin-console, 389-console, 389-ds-console, 389-dsgw, libmozilla-ldap-perl, svrcore
- 6 days old (2 needed)
- missing build on armel: 389-ds-base, 389-ds-base-dev, 389-ds-base-libs (from 1.3.8.2-1)
- missing build on mips: 389-ds-base, 389-ds-base-dev, 389-ds-base-libs (from 1.3.8.2-1)
- missing build on mipsel: 389-ds-base, 389-ds-base-dev, 389-ds-base-libs (from 1.3.8.2-1)
- old binaries left on all: 389-ds, python3-dirsrvtests, python3-lib389 (from 1.3.8.2-1) (but ignoring cruft, so nevermind)
- Updating 389-ds-base introduces new bugs: #905184, #910982
- Piuparts tested OK - https://piuparts.debian.org/sid/source/3/389-ds-base.html
- Required age reduced by 3 days because of autopkgtest
- Not considered

news

[rss feed]

[2018-10-10] Accepted 389-ds-base 1.4.0.18-1 (source) into unstable (Timo Aaltonen)
[2018-09-29] Accepted 389-ds-base 1.3.3.5-4+deb8u3 (source all amd64) into oldstable (Hugo Lefeuvre)
[2018-09-27] Accepted 389-ds-base 1.4.0.16-1 (source) into unstable (Timo Aaltonen)
[2018-08-30] Accepted 389-ds-base 1.3.3.5-4+deb8u2 (source all amd64) into oldstable (Mike Gabriel)
[2018-08-23] Accepted 389-ds-base 1.4.0.15-2 (source) into unstable (Timo Aaltonen)
[2018-08-22] Accepted 389-ds-base 1.4.0.15-1 (source) into unstable (Timo Aaltonen)
[2018-08-01] Accepted 389-ds-base 1.4.0.13-1 (source amd64 all) into experimental, experimental (Timo Aaltonen)
[2018-07-15] Accepted 389-ds-base 1.3.3.5-4+deb8u1 (source all amd64) into oldstable (Thorsten Alteholz)
[2018-07-08] 389-ds-base REMOVED from testing (Debian testing watch)
[2018-06-03] 389-ds-base 1.3.8.2-1 MIGRATED to testing (Debian testing watch)
[2018-06-01] Accepted 389-ds-base 1.3.8.2-1 (source) into unstable (Timo Aaltonen)
[2018-03-18] 389-ds-base 1.3.7.10-1 MIGRATED to testing (Debian testing watch)
[2018-03-13] Accepted 389-ds-base 1.3.7.10-1 (source) into unstable (Timo Aaltonen)
[2018-02-11] 389-ds-base 1.3.7.9-1 MIGRATED to testing (Debian testing watch)
[2018-02-05] Accepted 389-ds-base 1.3.7.9-1 (source) into unstable (Timo Aaltonen)
[2017-12-21] Accepted 389-ds-base 1.3.7.8-4 (source) into unstable (Timo Aaltonen)
[2017-12-20] Accepted 389-ds-base 1.3.7.8-3 (source) into unstable (Timo Aaltonen)
[2017-12-20] Accepted 389-ds-base 1.3.7.8-2 (source) into unstable (Timo Aaltonen)
[2017-12-13] Accepted 389-ds-base 1.3.7.8-1 (source amd64 all) into unstable, unstable (Timo Aaltonen)
[2017-10-04] Accepted 389-ds-base 1.3.7.5-1 (source) into unstable (Timo Aaltonen)
[2017-09-21] Accepted 389-ds-base 1.3.6.7-5 (source) into unstable (Timo Aaltonen)
[2017-09-12] 389-ds-base REMOVED from testing (Debian testing watch)
[2017-09-04] 389-ds-base 1.3.6.7-4 MIGRATED to testing (Debian testing watch)
[2017-08-29] Accepted 389-ds-base 1.3.6.7-4 (source) into unstable (Timo Aaltonen)
[2017-08-28] Accepted 389-ds-base 1.3.6.7-3 (source) into unstable (Timo Aaltonen)
[2017-08-24] Accepted 389-ds-base 1.3.6.7-2 (source) into unstable (Timo Aaltonen)
[2017-08-22] Accepted 389-ds-base 1.3.6.7-1 (source) into unstable (Timo Aaltonen)
[2017-05-15] 389-ds-base 1.3.5.17-2 MIGRATED to testing (Debian testing watch)
[2017-05-10] Accepted 389-ds-base 1.3.6.5-1 (source) into experimental (Timo Aaltonen)
[2017-05-10] Accepted 389-ds-base 1.3.5.17-2 (source) into unstable (Timo Aaltonen)

bugs [bug history graph]

all: 4
RC: 1
I&N: 3
M&W: 0
F&P: 0
patch: 1

links

homepage
lintian (46, 44)
buildd: logs, checks, clang
popcon
debci
browse source code
edit tags
security tracker
screenshots

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1.4.0.18-1
4 bugs