Blame SOURCES/cve-2021-3480-fix.patch
|
 |
07b6f3 |
From 2f2b7ecd9d6a0f5044c24e4f96464942a1d873db Mon Sep 17 00:00:00 2001
|
|
|
07b6f3 |
From: Alexander Bokovoy <abokovoy@redhat.com>
|
|
|
07b6f3 |
Date: Wed, 7 Apr 2021 14:40:52 +0300
|
|
|
07b6f3 |
Subject: [PATCH] CVE-2021-3480: invalid bind DN crash
|
|
|
07b6f3 |
|
|
|
07b6f3 |
For certain LDAP bind operations 389-ds would pass unvalidated bind DN
|
|
|
07b6f3 |
to bind plugins. A first attempt to normalize the DN would find that out
|
|
|
07b6f3 |
and should reject the request.
|
|
|
07b6f3 |
|
|
|
07b6f3 |
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
|
|
|
07b6f3 |
---
|
|
|
07b6f3 |
src/back-sch.c | 5 +++++
|
|
|
07b6f3 |
1 file changed, 5 insertions(+)
|
|
|
07b6f3 |
|
|
|
07b6f3 |
diff --git a/src/back-sch.c b/src/back-sch.c
|
|
|
07b6f3 |
index a5e4c04..d806627 100644
|
|
|
07b6f3 |
--- a/src/back-sch.c
|
|
|
07b6f3 |
+++ b/src/back-sch.c
|
|
|
07b6f3 |
@@ -1988,6 +1988,11 @@ backend_locate_cb(const char *group, const char *set, bool_t flag,
|
|
|
07b6f3 |
rdn = slapi_rdn_new_sdn(cbdata->target_dn);
|
|
|
07b6f3 |
if (rdn != NULL) {
|
|
|
07b6f3 |
rdnstr = slapi_rdn_get_nrdn(rdn);
|
|
|
07b6f3 |
+ if (rdnstr == NULL) {
|
|
|
07b6f3 |
+ /* normalizing RDN failed, break the search */
|
|
|
07b6f3 |
+ slapi_rdn_free(&rdn;;
|
|
|
07b6f3 |
+ return FALSE;
|
|
|
07b6f3 |
+ }
|
|
|
07b6f3 |
if (map_match(cbdata->state, group, set, &flag,
|
|
|
07b6f3 |
strlen(rdnstr), rdnstr,
|
|
|
07b6f3 |
&ndnlen, &ndn,
|
|
|
07b6f3 |
--
|
|
|
07b6f3 |
2.31.1
|
|
|
07b6f3 |
|