Bug 1946632

Summary: CVE-2020-35518 389-ds:1.4/389-ds-base: information disclosure during the binding of a DN [rhel-8] [rhel-8.2.0.z]
Product: Red Hat Enterprise Linux 8 Reporter: RHEL Program Management Team <pgm-rhel-tools>
Component: 389-ds-baseAssignee: thierry bordaz <tbordaz>
Status: CLOSED ERRATA QA Contact: RHDS QE <ds-qe-bugs>
Severity: urgent Docs Contact:
Priority: urgent    
Version: 8.4CC: ldap-maint, mreynolds, msauton, sgouvern, tkubota, tscherf
Target Milestone: betaKeywords: Security, SecurityTracking, TestCaseProvided, Triaged, ZStream
Target Release: ---Flags: pm-rhel: mirror+
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: No Doc Update
Doc Text:
Story Points: ---
Clone Of: 1904991 Environment:
Last Closed: 2021-04-19 15:49:49 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1904991    
Bug Blocks: 1905565    

Comment 7 sgouvern 2021-04-17 15:58:33 UTC
================================= test session starts ==================================
platform linux -- Python 3.6.8, pytest-6.2.3, py-1.10.0, pluggy-0.13.1 -- /usr/bin/python3.6
cachedir: .pytest_cache
metadata: {'Python': '3.6.8', 'Platform': 'Linux-4.18.0-193.el8.x86_64-x86_64-with-redhat-8.2-Ootpa', 'Packages': {'pytest': '6.2.3', 'py': '1.10.0', 'pluggy': '0.13.1'}, 'Plugins': {'metadata': '1.11.0', 'html': '3.1.1', 'libfaketime': '0.1.2'}}
389-ds-base: 1.4.2.4-13.module+el8.2.0+10648+abe88955
nss: 3.44.0-15.el8
nspr: 4.21.0-2.el8_0
openldap: 2.4.46-11.el8
cyrus-sasl: 2.1.27-1.el8
FIPS: disabled
rootdir: /mnt/tests/rhds/tests/upstream/ds/dirsrvtests, configfile: pytest.ini
plugins: metadata-1.11.0, html-3.1.1, libfaketime-0.1.2
collected 2 items                                                                      

dirsrvtests/tests/suites/basic/basic_test.py::test_bind_invalid_entry PASSED     [ 50%]
dirsrvtests/tests/suites/basic/basic_test.py::test_bind_entry_missing_passwd PASSED [100%]

=========================== 2 passed, 16 warnings in 12.89s ============================

marking as Verified

Comment 11 errata-xmlrpc 2021-04-19 15:49:49 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: 389-ds:1.4 security and bug fix update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2021:1258