CVE-2020-35518
Published: 26 March 2021
When binding against a DN during authentication, the reply from 389-ds-base will be different whether the DN exists or not. This can be used by an unauthenticated attacker to check the existence of an entry in the LDAP database.
Priority
Status
| Package | Release | Status |
|---|---|---|
|
389-ds-base
Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(code not present)
|
| focal |
Released
(1.4.3.6-2ubuntu0.1~esm1)
Available with Ubuntu Pro |
|
| groovy |
Ignored
(end of life)
|
|
| hirsute |
Not vulnerable
(1.4.4.11-1)
|
|
| impish |
Not vulnerable
(1.4.4.11-2build1)
|
|
| jammy |
Not vulnerable
(2.0.2)
|
|
| kinetic |
Not vulnerable
(2.0.2)
|
|
| lunar |
Not vulnerable
(2.0.2)
|
|
| mantic |
Not vulnerable
(2.0.2)
|
|
| noble |
Not vulnerable
(2.0.2)
|
|
| trusty |
Does not exist
(trusty was not-affected [code not present])
|
|
| upstream |
Released
(1.4.2.17, 1.4.3.18, 1.4.4.10, 2.0.2)
|
|
| xenial |
Not vulnerable
(code not present)
|
|
|
Patches:
upstream: https://github.com/389ds/389-ds-base/commit/cc0f69283abc082488824702dae485b8eae938bc upstream: https://github.com/389ds/389-ds-base/commit/38b97faef8a6421a7a638ecdbf0b341e2b3f9ab3 upstream: https://github.com/389ds/389-ds-base/commit/c8e77b811b2f07a71c9cd0058a83e77e47edcd72 upstream: https://github.com/389ds/389-ds-base/commit/16d9020a8ae1bd5ed1fd7ca1ad8041c889a88c1f |
||
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 5.3 |
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | Low |
| Integrity impact | None |
| Availability impact | None |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |