Security update for 389-ds

Announcement ID:	SUSE-SU-2024:3082-1
Rating:	important
References:	bsc#1225507 bsc#1225512 bsc#1226277 bsc#1228912
Cross-References:	CVE-2024-2199 CVE-2024-3657 CVE-2024-5953
CVSS scores:	CVE-2024-2199 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2024-3657 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2024-5953 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected Products:	openSUSE Leap 15.5 Server Applications Module 15-SP5 SUSE Linux Enterprise High Performance Computing 15 SP5 SUSE Linux Enterprise Real Time 15 SP5 SUSE Linux Enterprise Server 15 SP5 SUSE Linux Enterprise Server for SAP Applications 15 SP5

An update that solves three vulnerabilities and has one security fix can now be installed.

Description:

This update for 389-ds fixes the following issues:

Security issues fixed:

• CVE-2024-3657: Fixed potential denial of service via specially crafted kerberos AS-REQ request (bsc#1225512)
• CVE-2024-5953: Fixed a denial of service caused by malformed userPassword hashes (bsc#1226277)
• CVE-2024-2199: Fixed a crash caused by malformed userPassword in do_modify() (bsc#1225507)

Non-security issues fixed:

• crash when user does change password using iso-8859-1 encoding (bsc#1228912)

• Update to version 2.2.10~git2.345056d3:

• Issue 2324 - Add a CI test (#6289)

• Issue 6284 - BUG - freelist ordering causes high wtime

• Update to version 2.2.10~git0.4d7218b7:

• Bump version to 2.2.10
• Issue 5327 - Fix test metadata
• Issue 5853 - Update Cargo.lock
• Issue 5962 - Rearrange includes for 32-bit support logic
• Issue 5973 - Fix fedora cop RawHide builds (#5974)
• Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
• Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
• Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
• Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
• Issue 6170 - audit log buffering doesn't handle large updates
• Issue 6193 - Test failure: test_tls_command_returns_error_text
• Issue 6189 - CI tests fail with [Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'
• Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
• Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
• Issue 6080 - ns-slapd crash in referint_get_config (#6081)
• Issue 6117 - Fix the UTC offset print (#6118)
• Issue 5305 - OpenLDAP version autodetection doesn't work
• Issue 6112 - RFE - add new operation note for MFA authentications
• Issue 5842 - Add log buffering to audit log
• Issue 6103 - New connection timeout error breaks errormap (#6104)
• Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
• Issue 6096 - Improve connection timeout error logging (#6097)
• Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
• Issue 5487 - Fix various isses with logconv.pl (#6085)

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• openSUSE Leap 15.5
  zypper in -t patch SUSE-2024-3082=1 openSUSE-SLE-15.5-2024-3082=1
• Server Applications Module 15-SP5
  zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP5-2024-3082=1

Package List:

• openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64)
  • 389-ds-2.2.10~git2.345056d3-150500.3.21.1
  • 389-ds-debugsource-2.2.10~git2.345056d3-150500.3.21.1
  • libsvrcore0-2.2.10~git2.345056d3-150500.3.21.1
  • 389-ds-snmp-2.2.10~git2.345056d3-150500.3.21.1
  • 389-ds-snmp-debuginfo-2.2.10~git2.345056d3-150500.3.21.1
  • 389-ds-debuginfo-2.2.10~git2.345056d3-150500.3.21.1
  • libsvrcore0-debuginfo-2.2.10~git2.345056d3-150500.3.21.1
  • 389-ds-devel-2.2.10~git2.345056d3-150500.3.21.1
  • lib389-2.2.10~git2.345056d3-150500.3.21.1
• Server Applications Module 15-SP5 (aarch64 ppc64le s390x x86_64)
  • 389-ds-2.2.10~git2.345056d3-150500.3.21.1
  • 389-ds-debugsource-2.2.10~git2.345056d3-150500.3.21.1
  • libsvrcore0-2.2.10~git2.345056d3-150500.3.21.1
  • 389-ds-debuginfo-2.2.10~git2.345056d3-150500.3.21.1
  • libsvrcore0-debuginfo-2.2.10~git2.345056d3-150500.3.21.1
  • 389-ds-devel-2.2.10~git2.345056d3-150500.3.21.1
  • lib389-2.2.10~git2.345056d3-150500.3.21.1

References:

• https://www.suse.com/security/cve/CVE-2024-2199.html
• https://www.suse.com/security/cve/CVE-2024-3657.html
• https://www.suse.com/security/cve/CVE-2024-5953.html
• https://bugzilla.suse.com/show_bug.cgi?id=1225507
• https://bugzilla.suse.com/show_bug.cgi?id=1225512
• https://bugzilla.suse.com/show_bug.cgi?id=1226277
• https://bugzilla.suse.com/show_bug.cgi?id=1228912