CVE-2021-3652
Published: 18 April 2022
A flaw was found in 389-ds-base. If an asterisk is imported as password hashes, either accidentally or maliciously, then instead of being inactive, any password will successfully match during authentication. This flaw allows an attacker to successfully authenticate as a user whose password was disabled.
Notes
| Author | Note |
|---|---|
| ccdm94 | this CVE is very similar to CVE-2017-15135. The patch for CVE-2017-15135 seems to fix this issue. CVE-2017-15135 was introduced in a patch for CVE-2016-5405, not applied in trusty and xenial. The patch for CVE-2017-15135 is included in the package for releases following xenial. |
Priority
Status
| Package | Release | Status |
|---|---|---|
|
389-ds-base Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(1.3.7.10-1ubuntu1)
|
| focal |
Not vulnerable
(1.3.7.10-1ubuntu1)
|
|
| hirsute |
Not vulnerable
(1.3.7.10-1ubuntu1)
|
|
| impish |
Not vulnerable
(1.3.7.10-1ubuntu1)
|
|
| jammy |
Not vulnerable
(1.3.7.10-1ubuntu1)
|
|
| trusty |
Does not exist
(trusty was not-affected [code not present])
|
|
| upstream |
Released
(1.3.7.9-1, 1.4.2.18, 1.4.3.25, 1.4.4.17, 2.0.7)
|
|
| xenial |
Not vulnerable
(code not present)
|
|
|
Patches: upstream: https://github.com/389ds/389-ds-base/commit/aeb90eb0c41fc48541d983f323c627b2e6c328c7 upstream: https://github.com/389ds/389-ds-base/commit/c1926dfc6591b55c4d33f9944de4d7ebe077e964 upstream: https://github.com/389ds/389-ds-base/commit/18271bad6395032a20465c7db9ea47636ad5fb45 upstream: https://github.com/389ds/389-ds-base/commit/fd4c991bd3da4c7d486a87ede8f4956cc6ed8a0d |
||
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 6.5 |
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | Low |
| Integrity impact | Low |
| Availability impact | None |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
References
- https://github.com/389ds/389-ds-base/issues/4817
- https://github.com/389ds/389-ds-base/commit/aeb90eb0c41fc48541d983f323c627b2e6c328c7 (master)
- https://github.com/389ds/389-ds-base/commit/c1926dfc6591b55c4d33f9944de4d7ebe077e964 (1.4.4.x)
- https://www.cve.org/CVERecord?id=CVE-2021-3652
- NVD
- Launchpad
- Debian