CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 1CVE-2022-0996 – 389-ds-base: expired password was still allowed to access the database
https://notcve.org/view.php?id=CVE-2022-0996
A vulnerability was found in the 389 Directory Server that allows expired passwords to access the database to cause improper authentication. Se encontró una vulnerabilidad en 389 Directory Server que permite que las contraseñas caducadas accedan a la base de datos para causar una autenticación inapropiada A vulnerability was found in the 389 Directory Server. This issue allows expired passwords to access the database, causing improper authentication. • https://bugzilla.redhat.com/show_bug.cgi?id=2064769 https://github.com/ByteHackr/389-ds-base https://lists.debian.org/debian-lts-announce/2023/04/msg00026.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4QFD7CBBX3IZOSHEWL2EYKRLOEQSXCZ6 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PYT2IQJFHQWZENJJRY6EJB3XIFZGNT7F https://access.redhat.com/security/cve/CVE-2022-0996 • CWE-287: Improper Authentication •
CVSS: 5.3EPSS: 0%CPEs: 6EXPL: 0CVE-2020-35518 – 389-ds-base: information disclosure during the binding of a DN
https://notcve.org/view.php?id=CVE-2020-35518
When binding against a DN during authentication, the reply from 389-ds-base will be different whether the DN exists or not. This can be used by an unauthenticated attacker to check the existence of an entry in the LDAP database. Cuando se vincula con un DN durante la autenticación, la respuesta de 389-ds-base será diferente si el DN se presenta o no. Esto puede ser usado por un atacante no autenticado para comprobar la existencia de una entrada en la base de datos de LDAP. • https://bugzilla.redhat.com/show_bug.cgi?id=1905565 https://github.com/389ds/389-ds-base/commit/b6aae4d8e7c8a6ddd21646f94fef1bf7f22c3f32 https://github.com/389ds/389-ds-base/commit/cc0f69283abc082488824702dae485b8eae938bc https://github.com/389ds/389-ds-base/issues/4480 https://access.redhat.com/security/cve/CVE-2020-35518 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-203: Observable Discrepancy •
CVSS: 4.6EPSS: 0%CPEs: 1EXPL: 0CVE-2019-10224 – 389-ds-base: using dscreate in verbose mode results in information disclosure
https://notcve.org/view.php?id=CVE-2019-10224
A flaw has been found in 389-ds-base versions 1.4.x.x before 1.4.1.3. When executed in verbose mode, the dscreate and dsconf commands may display sensitive information, such as the Directory Manager password. An attacker, able to see the screen or record the terminal standard error output, could use this flaw to gain sensitive information. Se ha encontrado un fallo en 389-ds-base versiones 1.4.x.x anteriores a 1.4.1.3. Cuando se ejecuta en modo verbose, los comandos dscreate y dsconf pueden mostrar información confidencial, tales como la contraseña de Directory Manager. • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10224 https://lists.debian.org/debian-lts-announce/2023/04/msg00026.html https://pagure.io/389-ds-base/issue/50251 https://access.redhat.com/security/cve/CVE-2019-10224 https://bugzilla.redhat.com/show_bug.cgi?id=1677147 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-522: Insufficiently Protected Credentials •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2019-10171 – 389-ds-base: Insufficient fix for CVE-2018-14648 denial of service in RHEL-7.5
https://notcve.org/view.php?id=CVE-2019-10171
It was found that the fix for CVE-2018-14648 in 389-ds-base, versions 1.4.0.x before 1.4.0.17, was incorrectly applied in RHEL 7.5. An attacker would still be able to provoke excessive CPU consumption leading to a denial of service. Se detectó que la corrección para el CVE-2018-14648 en 389-ds-base, versiones 1.4.0.x anteriores a 1.4.0.17, se aplicó incorrectamente en RHEL versión 7.5. Un atacante podría aún ser capaz de provocar un consumo excesivo de CPU conllevando a una denegación de servicio. It was found that the fix for CVE-2018-14648 was incorrectly applied in RHEL 7.5. • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10171 https://access.redhat.com/security/cve/CVE-2019-10171 https://bugzilla.redhat.com/show_bug.cgi?id=1722081 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 7.5EPSS: 4%CPEs: 3EXPL: 0CVE-2019-3883 – 389-ds-base: DoS via hanging secured connections
https://notcve.org/view.php?id=CVE-2019-3883
In 389-ds-base up to version 1.4.1.2, requests are handled by workers threads. Each sockets will be waited by the worker for at most 'ioblocktimeout' seconds. However this timeout applies only for un-encrypted requests. Connections using SSL/TLS are not taking this timeout into account during reads, and may hang longer.An unauthenticated attacker could repeatedly create hanging LDAP requests to hang all the workers, resulting in a Denial of Service. En 389-ds-base hasta la versión 1.4.1.2, las peticiones son manejadas por hilos de trabajo. • https://access.redhat.com/errata/RHSA-2019:1896 https://access.redhat.com/errata/RHSA-2019:3401 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3883 https://lists.debian.org/debian-lts-announce/2019/05/msg00008.html https://lists.debian.org/debian-lts-announce/2023/04/msg00026.html https://pagure.io/389-ds-base/issue/50329 https://pagure.io/389-ds-base/pull-request/50331 https://access.redhat.com/security/cve/CVE-2019-3883 https://bugzilla.redhat.com/show_bu • CWE-772: Missing Release of Resource after Effective Lifetime •