Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 849401 (CVE-2022-1949)

Summary: net-nds/389-ds-base: access control bypass vulnerability
Product: Gentoo Security Reporter: John Helmert III <ajak>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Status: CONFIRMED ---    
Severity: trivial CC: chris, Dessa, proxy-maint
Priority: Normal    
Version: unspecified   
Hardware: All   
OS: Linux   
Whiteboard: ~4 [ebuild]
Package list:
Runtime testing required: ---

Description John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-06-02 22:02:28 UTC

An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would yield incorrect results, but as that has progressed, can be determined that it actually is an access control bypass. This may allow any remote unauthenticated user to issue a filter that allows searching for database items they do not have access to, including but not limited to potentially userPassword hashes and other sensitive data.

Redhat bug:

There are some PRs upstream with potential fixes:
Comment 1 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-08-18 00:41:49 UTC
If I'm reading this git spaghetti correctly, it looks like this made it into 2.0.16, 2.1.2, and 2.2.2