|
 |
a3727e |
From 63fa3ee665b66b36321489c090b24811838837c0 Mon Sep 17 00:00:00 2001
|
|
|
a3727e |
From: Mark Reynolds <mreynolds@redhat.com>
|
|
|
a3727e |
Date: Tue, 3 Sep 2019 13:15:45 -0400
|
|
|
a3727e |
Subject: [PATCH] CVE-2019-14824 (BZ#1748199) - deref plugin displays
|
|
|
a3727e |
restricted attributes
|
|
|
a3727e |
|
|
|
a3727e |
Bug Description: If there is an ACI that allows "search" access to an attribute,
|
|
|
a3727e |
the deref plugin access control checks sees this is a "read"
|
|
|
a3727e |
privilege and returns the attribute's value.
|
|
|
a3727e |
|
|
|
a3727e |
Fix description: For deref plugin we are only concerned with "read" access, not
|
|
|
a3727e |
"search" access. Removed the SLAPI_ACL_SEARCH right flag when
|
|
|
a3727e |
checking access for an attribute.
|
|
|
a3727e |
|
|
|
a3727e |
Reviewed by: lkrispen & tbordaz(Thanks!)
|
|
|
a3727e |
---
|
|
|
a3727e |
ldap/servers/plugins/deref/deref.c | 6 +++---
|
|
|
a3727e |
1 file changed, 3 insertions(+), 3 deletions(-)
|
|
|
a3727e |
|
|
|
a3727e |
diff --git a/ldap/servers/plugins/deref/deref.c b/ldap/servers/plugins/deref/deref.c
|
|
|
a3727e |
index cb5ebb830..ec1884ba3 100644
|
|
|
a3727e |
--- a/ldap/servers/plugins/deref/deref.c
|
|
|
a3727e |
+++ b/ldap/servers/plugins/deref/deref.c
|
|
|
a3727e |
@@ -573,7 +573,7 @@ deref_do_deref_attr(Slapi_PBlock *pb, BerElement *ctrlber, const char *derefdn,
|
|
|
a3727e |
Slapi_Entry **entries = NULL;
|
|
|
a3727e |
int rc;
|
|
|
a3727e |
|
|
|
a3727e |
- /* If the access check on the attributes is done without retrieveing the entry
|
|
|
a3727e |
+ /* If the access check on the attributes is done without retrieving the entry
|
|
|
a3727e |
* it cannot handle acis which need teh entry, eg to apply a targetfilter rule
|
|
|
a3727e |
* So the determination of attrs which can be dereferenced is delayed
|
|
|
a3727e |
*/
|
|
|
a3727e |
@@ -596,7 +596,7 @@ deref_do_deref_attr(Slapi_PBlock *pb, BerElement *ctrlber, const char *derefdn,
|
|
|
a3727e |
int ii;
|
|
|
a3727e |
int needattrvals = 1; /* need attrvals sequence? */
|
|
|
a3727e |
if (deref_check_access(pb, entries[0], derefdn, attrs, &retattrs,
|
|
|
a3727e |
- (SLAPI_ACL_SEARCH | SLAPI_ACL_READ))) {
|
|
|
a3727e |
+ SLAPI_ACL_READ)) {
|
|
|
a3727e |
slapi_log_err(SLAPI_LOG_PLUGIN, DEREF_PLUGIN_SUBSYSTEM,
|
|
|
a3727e |
"deref_do_deref_attr - The client does not have permission to read the requested "
|
|
|
a3727e |
"attributes in entry %s\n",
|
|
|
a3727e |
@@ -714,7 +714,7 @@ deref_pre_entry(Slapi_PBlock *pb)
|
|
|
a3727e |
attrs[1] = NULL;
|
|
|
a3727e |
|
|
|
a3727e |
if (deref_check_access(pb, ent, NULL, attrs, &retattrs,
|
|
|
a3727e |
- (SLAPI_ACL_SEARCH | SLAPI_ACL_READ))) {
|
|
|
a3727e |
+ SLAPI_ACL_READ)) {
|
|
|
a3727e |
slapi_log_err(SLAPI_LOG_PLUGIN, DEREF_PLUGIN_SUBSYSTEM,
|
|
|
a3727e |
"deref_pre_entry - The client does not have permission to read attribute %s in entry %s\n",
|
|
|
a3727e |
spec->derefattr, slapi_entry_get_dn_const(ent));
|
|
|
a3727e |
--
|
|
|
a3727e |
2.21.0
|
|
|
a3727e |
|