Updated 389-ds-base packages fix security vulnerabilityPublication date: 16 Sep 2017
Affected Mageia releases : 5 , 6
The directory server password lockout policy prevents binds from operating once a threshold of failed passwords has been met. During this lockout, if you bind with a successful password, a different error code is returned. This means that an attacker has no ratelimit or penalty during an account lock, and can continue to attempt passwords via bruteforce, using the change in return code to ascertain a sucessful password auth (CVE-2017-7551).