a user whose password was expired was still allowed to access the database as if the password was not expired. Once a password is expired, and "grace logins" have been used up, the account is basically supposed to be locked out and should not be allowed to perform any privileged action.
Created 389-ds-base tracking bugs for this issue: Affects: fedora-all [bug 2066142]
Upstream ticket: https://github.com/389ds/389-ds-base/issues/5221
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2022:5239 https://access.redhat.com/errata/RHSA-2022:5239
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Extended Update Support Via RHSA-2022:5620 https://access.redhat.com/errata/RHSA-2022:5620
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2022:5823 https://access.redhat.com/errata/RHSA-2022:5823
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2022-0996
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2022:8162 https://access.redhat.com/errata/RHSA-2022:8162
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.0 Extended Update Support Via RHSA-2022:8976 https://access.redhat.com/errata/RHSA-2022:8976