huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
SSRF incorrect access control vulnerability allows unauthenticated users to make grafana send HTTP requests to any URL
CVE: CVE-2020-13379
Component: grafana
CWE: CWE-476
Severity: Important
CVSS v3: 8.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Release date: 2020-06-03T00:00:00+00:00

An SSRF incorrect access control vulnerability was found in Grafana regarding the avatar feature, allowing any unauthenticated user or client to make Grafana send HTTP requests to any URL and then return its result to the user or client. Additionally, the same issue can create a NULL pointer dereference vulnerability. This flaw allows an attacker to gain information about the network that Grafana is running on, or cause a segmentation fault, resulting in a denial of service.

Statement: In both OpenShift Container Platform (OCP) and OpenShift ServiceMesh (OSSM), the Grafana containers are behind OpenShift OAuth restricting access to the vulnerable path to authenticated users only. However, other pods may still access the vulnerable URL within the cluster. Therefore the impact is moderate for both (OCP and OSSM).

Red Hat Ceph Storage 2 is now in Extended Life Support (ELS) Phase of the support. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Ceph Storage Life Cycle: https://access.redhat.com/support/policy/updates/ceph-storage

Remediation:
For OpenShift Container Platform 4.4 see the following documentation, which
will be updated shortly for release 4.4.11, for important instructions on
how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.openshift.com/container-platform/4.4/release_notes/ocp-4-4-release-notes.html

Details on how to access this content are available at
https://docs.openshift.com/container-platform/4.4/updating/updating-cluster-cli.html.
The OpenShift Service Mesh release notes provide information on the features and
known issues:

https://docs.openshift.com/container-platform/latest/service_mesh/servicemesh-release-notes.html
The OpenShift Service Mesh release notes provide information on the features and
known issues:

https://docs.openshift.com/container-platform/latest/service_mesh/servicemesh-release-notes.html
This issue can be mitigated by blocking access to the URL path /avatar/*, through a method such as a reverse proxy, load balancer, application firewall etc.
XSS relating to the transformation feature
CVE: CVE-2020-26934
Component: phpmyadmin
CVSS v3: 7.5/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Release date: 2020-10-10T00:00:00+00:00

phpMyAdmin before 4.9.6 and 5.x before 5.0.3 allows XSS through the transformation feature via a crafted link.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Server: Optimizer unspecified vulnerability (CPU Oct 2020)
CVE: CVE-2020-14845
Component: mysql
Severity: Moderate
CVSS v3: 5.9/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-10-20T00:00:00+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.21 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
Prototype Pollution via loadPackageDefinition
CVE: CVE-2020-7768
Component: nodejs-grpc
CWE: CWE-400
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-08-14T00:00:00+00:00

A flaw was found in nodejs-grpc, where the package @grpc/grpc-js is vulnerable to Prototype Pollution via the loadPackageDefinition. The highest threat from this vulnerability is to system availability.

Statement: This vulnerability is related to the Node.js grpc package (grpc-node and a new version of it @grpc/grpc-js). The OpenShift Container Platform (OCP) delivers the grpc package, but it is the C-based gRPC version that contains source code for gRPC libraries. Therefore it is not affected by this vulnerability.

Remediation:
limitation in the OVS packet parsing in userspace leads to DoS
CVE: CVE-2020-35498
Component: openvswitch
CWE: CWE-400
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-01-01T00:00:00+00:00

A vulnerability was found in openvswitch. A limitation in the implementation of userspace packet parsing can allow a malicious user to send a specially crafted packet causing the resulting megaflow in the kernel to be too wide, potentially causing a denial of service. The highest threat from this vulnerability is to system availability.

Statement: Red Hat OpenStack Platform 13's openvswitch package will receive it's fixes from Fast Datapath.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/2974891
CSRF vulnerability in rails-ujs
CVE: CVE-2020-8167
Component: rubygem-actionview
CWE: CWE-352
Severity: Moderate
CVSS v3: 0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N
Release date: 2020-05-18T00:00:00+00:00

A flaw was found in rubygem-actionview. A regression of CVE-2015-1840 causes Rails-ujs to send CSRF tokens to wrong domains. The highest threat from this vulnerability is to data integrity.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
encoding/xml: XML element instability
CVE: CVE-2020-29511
Component: go
CWE: CWE-115
Severity: Low
CVSS v3: 5.6/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Release date: 2020-12-14T00:00:00+00:00

A flaw was found in go. Encoding and decoding of XML elements could lead to changes in the observed integrity. An attacker could use this flaw to trick applications which rely on element integrity for security decisions to make those decisions incorrectly. Known vulnerability use-cases are SAML and XML-DSig.

Statement: All uses of xml/encoding package in OpenShift Container Platform, OpenShift Jaeger,  OpenShift Service Mesh (OSSM), OpenShift Virtualization and OpenShift Container Storage do not rely on XML stability. We have assigned CVE-2020-27846 for crewjam/saml, and CVE-2020-27847 for dexidp/dex Go modules which are known to use encoding/xml in an unsafe way.

As it is unlikely for there to be any fix for this issue in Go's encoding/xml library, and the library should not be relied upon for security-sensitive protocols such as SAML and XML-DSig, there is currently no plan to fix this in golang as shipped in Red Hat Enterprise Linux 7, 8, or Red Hat Developer Tools.

Remediation:
While there is unlikely to be any fix for this issue Go's encoding/xml library affected users can workaround the vulnerability by using Mattermost's xml-roundtrip-validator [1].

[1] https://github.com/mattermost/xml-roundtrip-validator
Out-of-bounds read in simple_decode_row() function
CVE: CVE-2020-35532
Component: LibRaw
CWE: CWE-125
Severity: Low
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2020-04-02T00:00:00+00:00

A vulnerability was found in LibRaw. An out-of-bounds read vulnerability exists within the "simple_decode_row()" function (libraw\src\x3f\x3f_utils_patched.cpp), which can be triggered via an image with a large row_stride field.


Remediation:
Insufficient policy enforcement in payments
CVE: CVE-2020-6483
Component: chromium-browser
Severity: Moderate
CVSS v3: 6.4/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2020-05-19T00:00:00+00:00

Insufficient policy enforcement in payments in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
Inappropriate implementation in WebRTC
CVE: CVE-2020-6529
Component: chromium-browser
Severity: Low
CVSS v3: 4.2/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2020-07-14T00:00:00+00:00

Inappropriate implementation in WebRTC in Google Chrome prior to 84.0.4147.89 allowed an attacker in a privileged network position to leak cross-origin data via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
Chart.yaml is not properly sanitized lead to injection of unwanted information into chart
CVE: CVE-2020-15184
Component: helm
CWE: CWE-400
Severity: Low
CVSS v3: 3.7/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Release date: 2020-09-18T00:00:00+00:00

In Helm before versions 2.16.11 and 3.3.2 there is a bug in which the `alias` field on a `Chart.yaml` is not properly sanitized. This could lead to the injection of unwanted information into a chart. This issue has been patched in Helm 3.3.2 and 2.16.11. A possible workaround is to manually review the `dependencies` field of any untrusted chart, verifying that the `alias` field is either not used, or (if used) does not contain newlines or path characters.


Remediation:
remote code execution via shell metacharacters in a configuration setting for im_convert_path or im_identify_path
CVE: CVE-2020-12641
Component: roundcubemail
CVSS v3: 8.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-04-29T00:00:00+00:00

rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
hard coded credential in ceph-ansible playbook
CVE: CVE-2020-1716
Component: ceph-ansible
CWE: CWE-798
Severity: Important
CVSS v3: 9.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-01-01T00:00:00+00:00

A flaw was found in the ceph-ansible playbook where it contained hardcoded passwords that were being used as default passwords while deploying Ceph services. Any authenticated attacker can abuse this flaw to brute-force Ceph deployments, and gain administrator access to Ceph clusters via the Ceph dashboard to initiate read, write, and delete Ceph clusters and also modify Ceph cluster configurations.

Statement: The version of ceph-ansible included in Red Hat OpenStack 15 was temporary, OpenStack 15 installations will consume updates to this package from Ceph channels.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Change and use strong passwords in ceph-ansible playbook

- https://github.com/ceph/ceph-ansible/blob/v4.0.14/roles/ceph-defaults/defaults/main.yml#L701
- https://github.com/ceph/ceph-ansible/blob/v4.0.14/roles/ceph-defaults/defaults/main.yml#L711
Arbitrary Code Execution vulnerability (APSB20-30)
CVE: CVE-2020-9633
Component: flash-plugin
CWE: CWE-416
Severity: Critical
CVSS v3: 9.8/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-06-09T00:00:00+00:00

A use-after-free flaw was found in the Adobe Flash Player. This flaw an attacker to perform arbitrary code execution when the Flash player is used to play a specially crafted SWF file. The highest threat from this vulnerability is to confidentiality, integrity and system availability.


Remediation:
use-of-uninitialized-value in _libssh2_transport_read
CVE: CVE-2020-22218
Component: libssh2
CWE: CWE-125
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-01-01T00:00:00+00:00

A flaw was found in the libssh2 library. An out-of-bounds access issue can occur due to an improper initialization of a variable, resulting in a crash in the application linked to the library.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing these updated packages, all running applications using libssh2 must be restarted for this update to take effect.
crafted packet allows remote attacker to cause denial of service
CVE: CVE-2020-10739
Component: istio/envoy
CWE: CWE-476
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-05-12T18:00:00+00:00

A null pointer exception flaw was found in servicemesh-proxy. When running Telemetry v2 (not on by default in version 1.4.x), an attacker could send a specially crafted packet to the ingress gateway or proxy sidecar, triggering a denial of service.


Remediation:
The OpenShift Service Mesh release notes provide information on the features and known issues:

https://docs.openshift.com/container-platform/latest/service_mesh/servicemesh-release-notes.html
Leave the telemetry reporting in OpenShift ServiceMesh set to the default component Mixer, leaving Telemetry V2 as disabled.
/usr/lib/tmpfiles.d/tomcat.conf is group-writable
CVE: CVE-2020-8022
Component: tomcat
CWE: CWE-276
Severity: Moderate
CVSS v3: 7.7/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Release date: 2020-06-29T00:00:00+00:00

A Incorrect Default Permissions vulnerability in the packaging of tomcat on SUSE Enterprise Storage 5, SUSE Linux Enterprise Server 12-SP2-BCL, SUSE Linux Enterprise Server 12-SP2-LTSS, SUSE Linux Enterprise Server 12-SP3-BCL, SUSE Linux Enterprise Server 12-SP3-LTSS, SUSE Linux Enterprise Server 12-SP4, SUSE Linux Enterprise Server 12-SP5, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 12-SP2, SUSE Linux Enterprise Server for SAP 12-SP3, SUSE Linux Enterprise Server for SAP 15, SUSE OpenStack Cloud 7, SUSE OpenStack Cloud 8, SUSE OpenStack Cloud Crowbar 8 allows local attackers to escalate from group tomcat to root. This issue affects: SUSE Enterprise Storage 5 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP2-BCL tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP2-LTSS tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP3-BCL tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP3-LTSS tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP4 tomcat versions prior to 9.0.35-3.39.1. SUSE Linux Enterprise Server 12-SP5 tomcat versions prior to 9.0.35-3.39.1. SUSE Linux Enterprise Server 15-LTSS tomcat versions prior to 9.0.35-3.57.3. SUSE Linux Enterprise Server for SAP 12-SP2 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server for SAP 12-SP3 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server for SAP 15 tomcat versions prior to 9.0.35-3.57.3. SUSE OpenStack Cloud 7 tomcat versions prior to 8.0.53-29.32.1. SUSE OpenStack Cloud 8 tomcat versions prior to 8.0.53-29.32.1. SUSE OpenStack Cloud Crowbar 8 tomcat versions prior to 8.0.53-29.32.1.

Statement: Red Hat OpenStack Platform's OpenDaylight will not be updated for this flaw because it was deprecated as of RHOSP14 and is only receiving security fixes for Important and Critical flaws.

Remediation:
Missing edit token in ApiPushBase.php facilitates CSRF attacks
CVE: CVE-2020-29004
Component: mediawiki
CWE: CWE-304
Severity: Moderate
CVSS v3: 5.8/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Release date: 2020-12-22T00:00:00+00:00

The API in the Push extension for MediaWiki through 1.35 did not require an edit token in ApiPushBase.php and therefore facilitated a CSRF attack.


Remediation:
unable to change visibility of log entries when MediaWiki:Mainpage uses Special:MyLanguage
CVE: CVE-2020-35477
Component: mediawiki
CWE: CWE-601
Severity: Low
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Release date: 2020-12-18T00:00:00+00:00

MediaWiki before 1.35.1 blocks legitimate attempts to hide log entries in some situations. If one sets MediaWiki:Mainpage to Special:MyLanguage/Main Page, visits a log entry on Special:Log, and toggles the "Change visibility of selected log entries" checkbox (or a tags checkbox) next to it, there is a redirection to the main page's action=historysubmit (instead of the desired behavior in which a revision-deletion form appears).


Remediation:
unspecified vulnerability fixed in 8u221 (JavaFX)
CVE: CVE-2020-2585
Component: JDK
Severity: Moderate
CVSS v3: 5.8/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Release date: 2020-01-14T00:00:00+00:00

Vulnerability in the Java SE product of Oracle Java SE (component: JavaFX). The supported version that is affected is Java SE: 8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).


Remediation:
heap buffer overflow in get_l2len() could result in a crash
CVE: CVE-2020-24266
Component: tcpreplay
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-10-19T00:00:00+00:00

An issue was discovered in tcpreplay tcpprep v4.3.3. There is a heap buffer overflow vulnerability in get_l2len() that can make tcpprep crash and cause a denial of service.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
FBZERO dissector could enter an infinite loop
CVE: CVE-2020-26575
Component: wireshark
CWE: CWE-835
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-10-06T00:00:00+00:00

In Wireshark through 3.2.7, the Facebook Zero Protocol (aka FBZERO) dissector could enter an infinite loop. This was addressed in epan/dissectors/packet-fbzero.c by correcting the implementation of offset advancement.

Statement: Wireshark as shipped with Red Hat Enterprise Linux 5, 6, and 7 is not affected by this flaw because the Facebook Zero Dissector was not yet introduced until version 2.4.0rc0.

Remediation:
libvncserver/rre.c allows out-of-bounds access via encodings
CVE: CVE-2020-14404
Component: libvncserver
CWE: CWE-125
Severity: Low
CVSS v3: 5.6/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
Release date: 2020-06-17T00:00:00+00:00

An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rre.c allows out-of-bounds access via encodings.


Remediation:
allows remote attackers to prevent legitimate server use by making enough connections to exceed the connection limit
CVE: CVE-2020-35359
Component: pure-ftpd
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-12-26T00:00:00+00:00

Pure-FTPd 1.0.48 allows remote attackers to prevent legitimate server use by making enough connections to exceed the connection limit.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
buffer overflow in crc64i() nasmlib/crc64.c
CVE: CVE-2020-18974
Component: nasm
CWE: CWE-119
Severity: Low
CVSS v3: 3.2/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2020-01-01T00:00:00+00:00

Buffer Overflow in Netwide Assembler (NASM) v2.15.xx allows attackers to cause a denial of service via 'crc64i' in the component 'nasmlib/crc64'. This issue is different than CVE-2019-7147.


Remediation:
Null Pointer Dereference in scan_unit_for_symbols could result in DoS
CVE: CVE-2020-16593
Component: binutils
CWE: CWE-476
Severity: Low
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2020-12-10T00:00:00+00:00

A Null Pointer Dereference vulnerability exists in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.35, in scan_unit_for_symbols, as demonstrated in addr2line, that can cause a denial of service via a crafted file.

Statement: binutils as shipped in Red Hat Developer Toolsets 9 and 10, Red Hat Enterprise Linux 8 BaseOS and GCC Toolsets 9 and 10, are all not affected by this flaw as it was introduced in a newer version of binutils code than shipped for BaseOS and the 9 toolsets, and already patched in the versions shipped with 10 toolsets.

Remediation:
ati-vga: OOB access while reading PCI configuration may lead to DoS
CVE: CVE-2020-13791
Component: QEMU
CWE: CWE-125
Severity: Low
CVSS v3: 2.0/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:L
Release date: 2020-06-03T00:00:00+00:00

An out-of-bounds access flaw was found in the ati-vga emulator of the QEMU. The issue occurs while reading PCI configuration bytes via the ati_mm_read routine if the address sent by a guest is towards an end of the PCI configuration space. This flaw allows a guest user or process to crash the QEMU process resulting in a denial of service.


Remediation:
assertion failure in Certificate List syntax validation
CVE: CVE-2020-25709
Component: openldap
CWE: CWE-617
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-11-02T00:00:00+00:00

A flaw was found in OpenLDAP. This flaw allows an attacker who can send a malicious packet to be processed by OpenLDAP’s slapd server, to trigger an assertion failure. The highest threat from this vulnerability is to system availability.

Statement: This flaw does not affect Red Hat Enterprise Linux 8 because the slapd server is not shipped in the Red Hat Enterprise Linux 8 repositories.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.