3.7
Faible
CVE-2026-15041 A flaw was found in 389 Directory Server
Description
A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password verification function uses standard memcmp() for comparing password hashes instead of a constant-time comparison function. A remote attacker could potentially use timing measurements of LDAP bind attempts to infer partial hash information, though practical exploitation is extremely difficult due to PBKDF2 computational overhead.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Red Hat Directory Server 11 | Versions non publiées | |
| Red Hat Directory Server 12 | Versions non publiées | |
| Red Hat Directory Server 13 | Versions non publiées | |
| Red Hat Enterprise Linux 10 | Versions non publiées | |
| Red Hat Enterprise Linux 6 | Versions non publiées | |
| Red Hat Enterprise Linux 7 | Versions non publiées | |
| Red Hat Enterprise Linux 8 | Versions non publiées | |
| Red Hat Enterprise Linux 9 | Versions non publiées |
Références
- access.redhat.com access.redhat.com
- RHBZ#2498022 bugzilla.redhat.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Red Hat Directory Server 11
Les 42 CVE de Red Hat Directory Server 11 →
CVE-2026-117548
389-ds-base: 389-ds-base: null pointer dereference via modifydn using an attribute's schema alias name causes denial of service
6.5
Moyenne
CVE-2026-86345
389-ds-base: 389-ds-base: starttls plaintext-buffer retention allows on-path attacker to forge an ldap client's authentication result
9.0
Critique
CVE-2026-86344
389-ds-base: 389-ds-base: unauthenticated worker-thread-pool exhaustion via completed-operation-then-incomplete-pdu connection requeue
7.5
Élevée
CVE-2026-19843
389-ds-base: 389-ds-base: command injection via unescaped ldap dn in cockpit 389 console ldap editor
8.4
Élevée