medium5.3
CVE-2020-35518
When binding against a DN during authentication, the reply from 389-ds-base will be different whether the DN exists or not.
Impact
When binding against a DN during authentication, the reply from 389-ds-base will be different whether the DN exists or not. This can be used by an unauthenticated attacker to check the existence of an entry in the LDAP database.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Redhat | 389 Directory Server | before 1.4.3.19 from 1.4.4.0 before 1.4.4.13 from 2.0.0 before 2.0.3 |
| Redhat | Directory Server | Version 11.0 |
| Redhat | Enterprise Linux | Versions 7.0, 8.0 |
Weakness classification
References
- NVD record
- CVE.org record
- https://bugzilla.redhat.com/show_bug.cgi?id=1905565
- https://github.com/389ds/389-ds-base/commit/b6aae4d8e7c8a6ddd21646f94fef1bf7f22c3f32
- https://github.com/389ds/389-ds-base/commit/cc0f69283abc082488824702dae485b8eae938bc
- https://github.com/389ds/389-ds-base/issues/4480
- https://bugzilla.redhat.com/show_bug.cgi?id=1905565
- https://github.com/389ds/389-ds-base/commit/b6aae4d8e7c8a6ddd21646f94fef1bf7f22c3f32
- https://github.com/389ds/389-ds-base/commit/cc0f69283abc082488824702dae485b8eae938bc
- https://github.com/389ds/389-ds-base/issues/4480