CVE-2019-14824

Name	CVE-2019-14824
Description	A flaw was found in the 'deref' plugin of 389-ds-base where it could use the 'search' permission to display attribute values. In some configurations, this could allow an authenticated attacker to view private attributes, such as password hashes.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-2004-1, DLA-3399-1
Debian Bugs	944150

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
389-ds-base (PTS)	bullseye	1.4.4.11-2	fixed
	bookworm	2.3.1+dfsg1-1	fixed
	sid	3.1.1+dfsg1-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
389-ds-base	source	jessie	1.3.3.5-4+deb8u7	DLA-2004-1
389-ds-base	source	buster	1.4.0.21-1+deb10u1	DLA-3399-1
389-ds-base	source	(unstable)	1.4.2.4-1		944150

Notes

[stretch] - 389-ds-base <no-dsa> (Minor issue)
https://bugzilla.redhat.com/show_bug.cgi?id=1747448
https://pagure.io/freeipa/issue/8050
https://github.com/389ds/389-ds-base/issues/3771