389-ds-base (1.4.0.21-1+deb10u1) buster-security; urgency=medium

389-ds-base (1.4.0.21-1+deb10u1) buster-security; urgency=medium

  * Non-maintainer upload by the LTS Security Team.
  * CVE-2021-4091: double free of the virtual attribute context in
                   persistent search.
  * CVE-2022-0918: an unauthenticated attacker with network access to
                   the LDAP port
                   can cause a denial of service.
  * CVE-2022-0996: expired password was still allowed to access the database.
  * CVE-2022-2850: possible NULL pointer dereference leading to a denial of
                   service.
  * CVE-2021-3652: importing an asterisk as password hashes enables successful
                   authentication with any password, allowing attackers to
                   access accounts with disabled passwords.
  * CVE-2021-3514: an authenticated attacker can crash 389-ds-base using a
                   specially crafted query in sync_repl client, due to a NULL
                   pointer dereference.
  * CVE-2019-14824:deref plugin vulnerability lets authenticated attackers
                   access private attributes, like password hashes, using the
                   'search' permission.
  * CVE-2019-10224:vulnerability that may disclose sensitive information,
                   including the Directory Manager password, when executing
                   dscreate and dsconf commands in verbose mode.and dsconf
                   commands in verbose mode and recording the terminal standard
                   error output.
  * CVE-2019-3883: SSL/TLS requests do not enforce ioblocktimeout limit, leading
                   to DoS vulnerability by hanging all workers with hanging LDAP
                   requests.

[dgit import unpatched 389-ds-base 1.4.0.21-1+deb10u1]