Stay Secure with the Latest Linux Advisories

security advisorycritical issueupdate

Debian: DLA-1483-1 Critical: Unhashed Password Threat in 389-ds-base

CVE-2018-10871 By default nsslapd-unhashed-pw-switch was set to 'on'. So a copy of . Package : 389-ds-base Version : 1.3.3.5-4+deb8u2 CVE ID : CVE-2018-10871 CVE-2018-10935 Debian Bug : 906985 CVE-2018-10871 By default nsslapd-unhashed-pw-switch was set to 'on'. So a copy of the unhashed password was kept in modifiers and was possibly logged in changelog and retroCL. Unless it is used by some plugin it does not require to keep unhashed passwords. The nsslapd-unhashed-pw-switch option is now 'off' by default. CVE-2018-10935 It was discovered that any authenticated user doing a search using ldapsearch with extended controls for server side sorting could bring down the LDAP server itself. The fix is to check if we are able to index the provided value. If we are not, then slapd_qsort returns an error (LDAP_OPERATION_ERROR) . For Debian 8 "Jessie", these problems have been fixed in version 1.3.3.5-4+deb8u2. We recommend that you upgrade your 389-ds-base packages. Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS -- mike gabriel aka sunweaver (Debian Developer) fon: +49 (1520) 1976 148 GnuPG Fingerprint: 9BFB AEE8 6C0A A5FF BF22 0782 9AF4 6B30 2577 1B31 mail: This email address is being protected from spambots. You need JavaScript enabled to view it., https://sunweavers.net/ . Debian users should be aware of a serious security advisory regarding unhashed passwords in the 389-ds-base package; update your systems immediately to ensure data protection. Debian Security Advisory, 389-ds-base Update, LDAP Server Security. . Severity: Critical. LinuxSecurity.com Team

Aug 30, 2018 •Critical Debian LTS