It was found that 389-ds-base since 1.3.6.1 up to and including 1.4.0.3 did not always handle internal hash comparison operations correctly during the authentication process. A remote, unauthenticated attacker could potentially use this flaw to bypass the authentication process under very rare and specific circumstances.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade 389-ds-base-debuginfoUpgrade 389-ds-base-snmpUpgrade 389-ds-base-libsUpgrade 389-ds-baseUpgrade 389-ds-base-devel | Apr 27, 2020 | Jan 24, 2018 |
| Amazon_linux | — | Upgrade 389-ds-base | Apr 6, 2018 | Jan 24, 2018 |
| Centos_linux | — | Upgrade 389-ds-base-snmpUpgrade 389-ds-base-debuginfoUpgrade 389-ds-base-libsUpgrade 389-ds-baseUpgrade 389-ds-base-devel | Mar 13, 2018 | Jan 24, 2018 |
| Debian | — | Upgrade 389-ds-base | Jul 30, 2024 | Jan 24, 2018 |
| Huawei Euleros 2_0_sp1 | — | Upgrade 389-ds-base-libsUpgrade 389-ds-base | May 2, 2018 | Jan 24, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade 389-ds-base-libsUpgrade 389-ds-base | May 2, 2018 | Jan 24, 2018 |
| Oracle_linux | — | Upgrade 389-ds-base-develUpgrade 389-ds-baseUpgrade 389-ds-base-snmpUpgrade 389-ds-base-libs | Mar 9, 2018 | Jan 22, 2018 |
| Redhat_linux | — | Upgrade 389-ds-base-snmpUpgrade 389-ds-base-debuginfoUpgrade 389-ds-baseUpgrade 389-ds-base-develUpgrade 389-ds-base-libs | Mar 7, 2018 | Jan 24, 2018 |
| Suse | — | Upgrade 389-ds-snmpUpgrade 389-ds-develUpgrade lib389Upgrade 389-dsUpgrade libsvrcore0 | May 16, 2019 | Jan 24, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub