| Package | Affected versions | Patched versions |
|---|---|---|
| policy auditor | = 6.5.1< 6.5.1 | 6.5.1 |
| openldap | < 2.4.48 | 2.4.48 |
| blockchain platform | < 21.1.2 | 21.1.2 |
| zfs storage appliance kit | = 8.8 |
An issue was discovered in the server in OpenLDAP before 2.4.48. When the server administrator delegates rootDN (database admin) privileges for certain databases but wants to maintain isolation (e.g., for multi-tenant deployments), slapd does not properly stop a rootDN from requesting authorization as an identity from another database during a SASL bind or with a proxyAuthz (RFC 4370) control. (It is not a common configuration to deploy a system where the server administrator and a DB administrator enjoy different levels of trust.)
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free