Debian Package Tracker

general

source: 389-ds-base (main)
version: 1.3.8.2-1
maintainer: Debian FreeIPA Team (archive) [DMD]
uploaders: Timo Aaltonen [DMD]
arch: all any
std-ver: 4.1.0
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

oldstable: 1.3.3.5-4
old-sec: 1.3.3.5-4+deb8u1
stable: 1.3.5.17-2
unstable: 1.3.8.2-1

versioned links

1.3.3.5-4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.3.3.5-4+deb8u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.3.4.9-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.3.5.17-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.3.8.2-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

389-ds
389-ds-base
389-ds-base-dev
389-ds-base-libs
python3-dirsrvtests
python3-lib389

action needed

A new upstream version is available: 1.4.0.11 high

A new upstream version 1.4.0.11 is available, you should consider packaging it.

Created: 2017-11-21 Last update: 2018-07-17 14:05

3 security issues in sid high

There are 3 open security issues in sid.

3 important issues:

CVE-2016-5416: 389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise Linux Server 6 through 7, and Red Hat Enterprise Linux Workstation 6 through 7 allows remote attackers to read the default Access Control Instructions.
CVE-2018-10850: 389-ds-base before versions 1.4.0.10, 1.3.8.3 is vulnerable to a race condition in the way 389-ds-base handles persistent search, resulting in a crash if the server is under load. An anonymous attacker could use this flaw to trigger a denial of service.
CVE-2018-10871:

Please fix them.

Created: 2016-06-18 Last update: 2018-07-16 08:08

7 security issues in stretch high

There are 7 open security issues in stretch.

6 important issues:

CVE-2017-7551: 389-ds-base version before 1.3.5.19 and 1.3.6.7 are vulnerable to password brute-force attacks during account lockout due to different return codes returned on password attempts.
CVE-2018-1054: An out-of-bounds memory read flaw was found in the way 389-ds-base handled certain LDAP search filters, affecting all versions including 1.4.x. A remote, unauthenticated attacker could potentially use this flaw to make ns-slapd crash via a specially crafted LDAP request, thus resulting in denial of service.
CVE-2017-15134: A stack buffer overflow flaw was found in the way 389-ds-base 1.3.6.x before 1.3.6.13, 1.3.7.x before 1.3.7.9, 1.4.x before 1.4.0.5 handled certain LDAP search filters. A remote, unauthenticated attacker could potentially use this flaw to make ns-slapd crash via a specially crafted LDAP request, thus resulting in denial of service.
CVE-2018-10871:
CVE-2018-1089: 389-ds-base before versions 1.4.0.9, 1.3.8.1, 1.3.6.15 did not properly handle long search filters with characters needing escapes, possibly leading to buffer overflows. A remote, unauthenticated attacker could potentially use this flaw to make ns-slapd crash via a specially crafted LDAP request, thus resulting in denial of service.
CVE-2018-10850: 389-ds-base before versions 1.4.0.10, 1.3.8.3 is vulnerable to a race condition in the way 389-ds-base handles persistent search, resulting in a crash if the server is under load. An anonymous attacker could use this flaw to trigger a denial of service.

1 issue skipped by the security teams:

CVE-2016-5416: 389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise Linux Server 6 through 7, and Red Hat Enterprise Linux Workstation 6 through 7 allows remote attackers to read the default Access Control Instructions.

Please fix them.

Created: 2016-06-18 Last update: 2018-07-16 08:08

4 security issues in jessie high

There are 4 open security issues in jessie.

1 important issue:

CVE-2018-10871:

3 issues skipped by the security teams:

CVE-2016-5416: 389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise Linux Server 6 through 7, and Red Hat Enterprise Linux Workstation 6 through 7 allows remote attackers to read the default Access Control Instructions.
CVE-2016-4992: 389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise Linux Server 6 through 7, and Red Hat Enterprise Linux Workstation 6 through 7 allows remote attackers to infer the existence of RDN component objects.
CVE-2016-5405: 389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise Linux Server 6 through 7, and Red Hat Enterprise Linux Workstation 6 through 7 allows remote attackers to obtain user passwords.

Please fix them.

Created: 2015-07-12 Last update: 2018-07-16 08:08

Multiarch hinter reports 2 issue(s) normal

There are issues with the multiarch metadata for this package.

389-ds-base-dev could be marked Multi-Arch: same
389-ds-base-libs could be marked Multi-Arch: same

Created: 2018-06-02 Last update: 2018-07-17 14:18

The package has not entered testing even though the delay is over normal

The package has not entered testing even though the 2-day delay is over. Check why.

Created: 2018-07-07 Last update: 2018-07-17 14:02

lintian reports 47 warnings normal

Lintian reports 47 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2018-04-11 Last update: 2018-05-15 07:42

Build log checks report 1 warning low

Build log checks report 1 warning

Created: 2017-10-26 Last update: 2017-10-26 01:26

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.1.5 instead of 4.1.0).

Created: 2017-10-04 Last update: 2018-07-15 19:22

testing migrations

This package is part of the ongoing testing transition known as python3.7. Please avoid uploads unrelated to this transition, they would likely delay it and require supplementary work from the release managers. On the other hand, if your package has problems preventing it to migrate to testing, please fix them as soon as possible. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
excuses:
- Migration status: Blocked. Can't migrate due to a non-migratable dependency. Check status below.
- Blocked by: 389-dsgw
- Migrates after: 389-admin, 389-admin-console, 389-console, 389-ds-console, libmozilla-ldap-perl
- 46 days old (2 needed)
- Piuparts tested OK - https://piuparts.debian.org/sid/source/3/389-ds-base.html
- autopkgtest for 389-ds-base/1.3.8.2-1: amd64: Pass
- Required age reduced by 3 days because of autopkgtest
- Invalidated by dependency
- Not considered

news

[rss feed]

[2018-07-15] Accepted 389-ds-base 1.3.3.5-4+deb8u1 (source all amd64) into oldstable (Thorsten Alteholz)
[2018-07-08] 389-ds-base REMOVED from testing (Debian testing watch)
[2018-06-03] 389-ds-base 1.3.8.2-1 MIGRATED to testing (Debian testing watch)
[2018-06-01] Accepted 389-ds-base 1.3.8.2-1 (source) into unstable (Timo Aaltonen)
[2018-03-18] 389-ds-base 1.3.7.10-1 MIGRATED to testing (Debian testing watch)
[2018-03-13] Accepted 389-ds-base 1.3.7.10-1 (source) into unstable (Timo Aaltonen)
[2018-02-11] 389-ds-base 1.3.7.9-1 MIGRATED to testing (Debian testing watch)
[2018-02-05] Accepted 389-ds-base 1.3.7.9-1 (source) into unstable (Timo Aaltonen)
[2017-12-21] Accepted 389-ds-base 1.3.7.8-4 (source) into unstable (Timo Aaltonen)
[2017-12-20] Accepted 389-ds-base 1.3.7.8-3 (source) into unstable (Timo Aaltonen)
[2017-12-20] Accepted 389-ds-base 1.3.7.8-2 (source) into unstable (Timo Aaltonen)
[2017-12-13] Accepted 389-ds-base 1.3.7.8-1 (source amd64 all) into unstable, unstable (Timo Aaltonen)
[2017-10-04] Accepted 389-ds-base 1.3.7.5-1 (source) into unstable (Timo Aaltonen)
[2017-09-21] Accepted 389-ds-base 1.3.6.7-5 (source) into unstable (Timo Aaltonen)
[2017-09-12] 389-ds-base REMOVED from testing (Debian testing watch)
[2017-09-04] 389-ds-base 1.3.6.7-4 MIGRATED to testing (Debian testing watch)
[2017-08-29] Accepted 389-ds-base 1.3.6.7-4 (source) into unstable (Timo Aaltonen)
[2017-08-28] Accepted 389-ds-base 1.3.6.7-3 (source) into unstable (Timo Aaltonen)
[2017-08-24] Accepted 389-ds-base 1.3.6.7-2 (source) into unstable (Timo Aaltonen)
[2017-08-22] Accepted 389-ds-base 1.3.6.7-1 (source) into unstable (Timo Aaltonen)
[2017-05-15] 389-ds-base 1.3.5.17-2 MIGRATED to testing (Debian testing watch)
[2017-05-10] Accepted 389-ds-base 1.3.6.5-1 (source) into experimental (Timo Aaltonen)
[2017-05-10] Accepted 389-ds-base 1.3.5.17-2 (source) into unstable (Timo Aaltonen)
[2017-05-09] Accepted 389-ds-base 1.3.5.17-1 (source) into unstable (Timo Aaltonen)
[2017-02-03] 389-ds-base 1.3.5.15-2 MIGRATED to testing (Debian testing watch)
[2017-01-26] Accepted 389-ds-base 1.3.5.15-2 (source) into unstable (Timo Aaltonen)
[2017-01-02] 389-ds-base 1.3.5.15-1 MIGRATED to testing (Debian testing watch)
[2016-12-23] Accepted 389-ds-base 1.3.5.15-1 (source) into unstable (Timo Aaltonen)
[2016-11-02] 389-ds-base 1.3.5.14-1 MIGRATED to testing (Debian testing watch)
[2016-10-27] Accepted 389-ds-base 1.3.5.14-1 (source) into unstable (Timo Aaltonen)

bugs [bug history graph]

all: 3
RC: 0
I&N: 3
M&W: 0
F&P: 0

links

homepage
lintian (0, 47)
buildd: logs, checks, clang
popcon
debci
browse source code
edit tags
security tracker
screenshots

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1.3.8.2-1
4 bugs