A flaw was found in 389-ds-base. If an asterisk is imported as password hashes, either accidentally or maliciously, then instead of being inactive, any password will successfully match during authentication. This flaw allows an attacker to successfully authenticate as a user whose password was disabled.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade 389-ds-base-legacy-toolsUpgrade 389-ds-baseUpgrade 389-ds-base-develUpgrade python3-lib389Upgrade 389-ds-base-snmpUpgrade 389-ds-base-libs | May 4, 2022 | Apr 18, 2022 |
| Amazon Linux Ami 2 | — | Upgrade 389-ds-base-debuginfoUpgrade 389-ds-base-snmpUpgrade 389-ds-baseUpgrade 389-ds-base-libsUpgrade 389-ds-base-devel | Jul 4, 2022 | Apr 18, 2022 |
| Amazon_linux | — | Upgrade 389-adminUpgrade 389-ds-base | Aug 5, 2022 | Aug 12, 2021 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Apr 18, 2022 |
| Centos_linux | — | Upgrade 389-ds-base-snmp-debuginfoUpgrade python3-lib389Upgrade 389-ds-base-libs-debuginfoUpgrade 389-ds-base-snmpUpgrade 389-ds-base-debuginfoUpgrade 389-ds-base-debugsourceUpgrade 389-ds-base-libsUpgrade 389-ds-base-legacy-toolsUpgrade 389-ds-base-legacy-tools-debuginfoUpgrade 389-ds-base-develUpgrade 389-ds-base | Aug 12, 2021 | Aug 10, 2021 |
| Debian | — | Upgrade 389-ds-base | Apr 25, 2023 | Apr 18, 2022 |
| Huawei Euleros 2_0_sp3 | — | Upgrade 389-ds-baseUpgrade 389-ds-base-libs | Feb 24, 2022 | Dec 31, 2021 |
| Huawei Euleros 2_0_sp5 | — | Upgrade 389-ds-baseUpgrade 389-ds-base-libs | Jan 4, 2022 | Dec 31, 2021 |
| Huawei Euleros 2_0_sp8 | — | Upgrade 389-ds-base-libs | Aug 18, 2022 | Apr 18, 2022 |
| Oracle_linux | — | Upgrade 389-ds-base-develUpgrade 389-ds-base-legacy-toolsUpgrade 389-ds-base-snmpUpgrade 389-ds-base-libsUpgrade 389-ds-baseUpgrade python3-lib389 | Aug 12, 2021 | Jun 29, 2021 |
| Redhat_linux | — | Upgrade 389-ds-base-debugsourceUpgrade 389-ds-base-develUpgrade 389-ds-base-legacy-tools-debuginfoUpgrade 389-ds-base-libsNo solution existsUpgrade 389-ds-base-debuginfoUpgrade python3-lib389Upgrade 389-ds-baseUpgrade 389-ds-base-snmp-debuginfoUpgrade 389-ds-base-libs-debuginfoUpgrade 389-ds-base-legacy-toolsUpgrade 389-ds-base-snmp | Aug 12, 2021 | Aug 10, 2021 |
| Rocky_linux | — | Upgrade 389-ds-base-libs-debuginfoUpgrade 389-ds-base-snmpUpgrade 389-ds-base-snmp-debuginfoUpgrade 389-ds-base-debuginfoUpgrade 389-ds-base-legacy-toolsUpgrade 389-ds-base-debugsourceUpgrade 389-ds-base-develUpgrade 389-ds-baseUpgrade 389-ds-base-legacy-tools-debuginfoUpgrade 389-ds-base-libs | Mar 12, 2024 | Apr 18, 2022 |
| Suse | — | Upgrade 389-ds-snmpUpgrade 389-dsUpgrade lib389Upgrade 389-ds-develUpgrade libsvrcore0 | Aug 21, 2021 | Aug 12, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub