REDHAT-BUG-1747448
First published: Fri Aug 30 2019(Updated: )
A vulnerability was found in 389-ds-base : the `deref` plugin is checking for either READ or SEARCH permission for dereferencing an attribute. This means that the SEARCH permission is sufficient to display an attribute via the plugin. This is relevant in particular in IdM/IPA environment, where a default ACI ("Search existence of password and kerberos keys") in set. This leads to dereferencing able to display userPassword content or any users.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| 389 Directory Server |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1768373
- https://access.redhat.com/errata/RHSA-2019:3401
- https://access.redhat.com/security/cve/cve-2019-14824
- https://access.redhat.com/errata/RHSA-2019:3981
- https://pagure.io/389-ds-base/c/ddbe3c8fe
- https://pagure.io/389-ds-base/issue/50716
- https://access.redhat.com/errata/RHSA-2020:0464
- https://bugzilla.redhat.com/show_bug.cgi?id=1747448
Frequently Asked Questions
What is the severity of REDHAT-BUG-1747448?
The severity of REDHAT-BUG-1747448 is considered moderate due to its potential impact on sensitive attribute visibility.
How do I fix REDHAT-BUG-1747448?
To fix REDHAT-BUG-1747448, update your 389 Directory Server to the latest version that addresses this vulnerability.
What software is affected by REDHAT-BUG-1747448?
REDHAT-BUG-1747448 affects the 389 Directory Server software.
What does REDHAT-BUG-1747448 involve?
REDHAT-BUG-1747448 involves a vulnerability in the deref plugin that improperly checks permissions for dereferencing attributes.
Can the vulnerability REDHAT-BUG-1747448 lead to unauthorized data exposure?
Yes, REDHAT-BUG-1747448 can lead to unauthorized exposure of attributes if adequate permissions are not enforced.
- agent/references
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2019-14824
- agent/severity
- agent/description
- agent/event
- agent/source
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/389 project
- canonical/389 directory server