It was found that 389-ds-base since 1.3.6.1 up to and including 1.4.0.3 did not always handle internal hash comparison operations correctly during the authentication process. A remote, unauthenticated attacker could potentially use this flaw to bypass the authentication process under very rare and specific circumstances.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-389-ds-baseamazon-linux-ami-2-upgrade-389-ds-base-debuginfoamazon-linux-ami-2-upgrade-389-ds-base-develamazon-linux-ami-2-upgrade-389-ds-base-libsamazon-linux-ami-2-upgrade-389-ds-base-snmp | Apr 27, 2020 | Jan 24, 2018 | |
| Amazon_linux | — | amazon-linux-upgrade-389-ds-base | Apr 6, 2018 | Jan 24, 2018 |
| Centos_linux | — | centos-upgrade-389-ds-basecentos-upgrade-389-ds-base-debuginfocentos-upgrade-389-ds-base-develcentos-upgrade-389-ds-base-libscentos-upgrade-389-ds-base-snmp | Mar 13, 2018 | Jan 24, 2018 |
| Debian | debian-upgrade-389-ds-base | Jul 30, 2024 | Jan 24, 2018 | |
| Huawei Euleros 2_0_sp1 | huawei-euleros-2_0_sp1-upgrade-389-ds-basehuawei-euleros-2_0_sp1-upgrade-389-ds-base-libs | May 2, 2018 | Jan 24, 2018 | |
| Huawei Euleros 2_0_sp2 | huawei-euleros-2_0_sp2-upgrade-389-ds-basehuawei-euleros-2_0_sp2-upgrade-389-ds-base-libs | May 2, 2018 | Jan 24, 2018 | |
| Oracle_linux | — | oracle-linux-upgrade-389-ds-baseoracle-linux-upgrade-389-ds-base-develoracle-linux-upgrade-389-ds-base-libsoracle-linux-upgrade-389-ds-base-snmp | Mar 9, 2018 | Jan 22, 2018 |
| Redhat_linux | — | redhat-upgrade-389-ds-baseredhat-upgrade-389-ds-base-debuginforedhat-upgrade-389-ds-base-develredhat-upgrade-389-ds-base-libsredhat-upgrade-389-ds-base-snmp | Mar 7, 2018 | Jan 24, 2018 |
| Suse | — | suse-upgrade-389-dssuse-upgrade-389-ds-develsuse-upgrade-389-ds-snmpsuse-upgrade-lib389suse-upgrade-libsvrcore0 | May 16, 2019 | Jan 24, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub