CVSS: 5.3EPSS: 0%CPEs: 6EXPL: 0CVE-2020-35518 – 389-ds-base: information disclosure during the binding of a DN
https://notcve.org/view.php?id=CVE-2020-35518
16 Feb 2021 — When binding against a DN during authentication, the reply from 389-ds-base will be different whether the DN exists or not. This can be used by an unauthenticated attacker to check the existence of an entry in the LDAP database. Cuando se vincula con un DN durante la autenticación, la respuesta de 389-ds-base será diferente si el DN se presenta o no. Esto puede ser usado por un atacante no autenticado para comprobar la existencia de una entrada en la base de datos de LDAP. Red Hat Directory Server is an LDA... • https://bugzilla.redhat.com/show_bug.cgi?id=1905565 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-203: Observable Discrepancy •
CVSS: 3.3EPSS: 0%CPEs: 4EXPL: 0CVE-2010-3282
https://notcve.org/view.php?id=CVE-2010-3282
09 Jan 2020 — 389 Directory Server before 1.2.7.1 (aka Red Hat Directory Server 8.2) and HP-UX Directory Server before B.08.10.03, when audit logging is enabled, logs the Directory Manager password (nsslapd-rootpw) in cleartext when changing cn=config:nsslapd-rootpw, which might allow local users to obtain sensitive information by reading the log. 389 Directory Server versiones anteriores a 1.2.7.1 (también se conoce como Red Hat Directory Server versión 8.2) y HP-UX Directory Server versiones anteriores a B.08.10.03, cu... • http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:6914 • CWE-312: Cleartext Storage of Sensitive Information •
CVSS: 7.5EPSS: 4%CPEs: 3EXPL: 0CVE-2019-3883 – 389-ds-base: DoS via hanging secured connections
https://notcve.org/view.php?id=CVE-2019-3883
17 Apr 2019 — In 389-ds-base up to version 1.4.1.2, requests are handled by workers threads. Each sockets will be waited by the worker for at most 'ioblocktimeout' seconds. However this timeout applies only for un-encrypted requests. Connections using SSL/TLS are not taking this timeout into account during reads, and may hang longer.An unauthenticated attacker could repeatedly create hanging LDAP requests to hang all the workers, resulting in a Denial of Service. En 389-ds-base hasta la versión 1.4.1.2, las peticiones so... • https://access.redhat.com/errata/RHSA-2019:1896 • CWE-772: Missing Release of Resource after Effective Lifetime •
CVSS: 7.8EPSS: 3%CPEs: 3EXPL: 0CVE-2018-14648 – 389-ds-base: Mishandled search requests in servers/slapd/search.c:do_search() allows for denial of service
https://notcve.org/view.php?id=CVE-2018-14648
28 Sep 2018 — A flaw was found in 389 Directory Server. A specially crafted search query could lead to excessive CPU consumption in the do_search() function. An unauthenticated attacker could use this flaw to provoke a denial of service. Se ha descubierto un problema en 389 Directory Server. Una cadena de consulta especialmente manipulada podría conducir a un consumo de CPU excesivo en la función do_search(). • https://access.redhat.com/errata/RHSA-2018:3127 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.5EPSS: 0%CPEs: 8EXPL: 0CVE-2018-14638 – 389-ds-base: Crash in delete_passwdPolicy when persistent search connections are terminated unexpectedly
https://notcve.org/view.php?id=CVE-2018-14638
14 Sep 2018 — A flaw was found in 389-ds-base before version 1.3.8.4-13. The process ns-slapd crashes in delete_passwdPolicy function when persistent search connections are terminated unexpectedly leading to remote denial of service. Se ha descubierto un problema en versiones anteriores a la 1.3.8.4-13 de 389-ds-base. El proceso ns-slapd se cierra inesperadamente en la función delete_passwdPolicy cuando las conexiones de búsqueda persistente se terminan inesperadamente, lo que conduce a una denegación de servicio (DoS) r... • https://access.redhat.com/errata/RHSA-2018:2757 • CWE-400: Uncontrolled Resource Consumption CWE-415: Double Free •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2018-10935 – 389-ds-base: ldapsearch with server side sort allows users to cause a crash
https://notcve.org/view.php?id=CVE-2018-10935
11 Sep 2018 — A flaw was found in the 389 Directory Server that allows users to cause a crash in the LDAP server using ldapsearch with server side sort. Se ha detectado un error en 389 Directory Server que permite que los usuarios provoquen el cierre inesperado del servidor LDAP mediante el uso de ldapsearch con orden del lado del servidor. 389 Directory Server is an LDAP version 3 compliant server. The base packages include the Lightweight Directory Access Protocol server and command-line utilities for server administra... • http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00033.html • CWE-20: Improper Input Validation CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.5EPSS: 0%CPEs: 11EXPL: 2CVE-2018-14624 – 389-ds-base: Server crash through modify command with large DN
https://notcve.org/view.php?id=CVE-2018-14624
06 Sep 2018 — A vulnerability was discovered in 389-ds-base through versions 1.3.7.10, 1.3.8.8 and 1.4.0.16. The lock controlling the error log was not correctly used when re-opening the log file in log__error_emergency(). An attacker could send a flood of modifications to a very large DN, which would cause slapd to crash. Se ha descubierto una vulnerabilidad en 389-ds-base hasta las versiones 1.3.7.10, 1.3.8.8 y 1.4.0.16. El bloqueo que controla el registro de errores no se empleaba correctamente al reabrir el archivo d... • http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00033.html • CWE-20: Improper Input Validation •
CVSS: 7.2EPSS: 0%CPEs: 3EXPL: 0CVE-2018-10871 – 389-ds-base: replication and the Retro Changelog plugin store plaintext password by default
https://notcve.org/view.php?id=CVE-2018-10871
18 Jul 2018 — 389-ds-base before versions 1.3.8.5, 1.4.0.12 is vulnerable to a Cleartext Storage of Sensitive Information. By default, when the Replica and/or retroChangeLog plugins are enabled, 389-ds-base stores passwords in plaintext format in their respective changelog files. An attacker with sufficiently high privileges, such as root or Directory Manager, can query these files in order to retrieve plaintext passwords. 389-ds-base en versiones anteriores a la 1.3.8.5 y 1.4.0.12 es vulnerable al almacenamiento en text... • https://access.redhat.com/errata/RHSA-2019:3401 • CWE-312: Cleartext Storage of Sensitive Information •
CVSS: 7.1EPSS: 1%CPEs: 10EXPL: 0CVE-2018-10850 – 389-ds-base: race condition on reference counter leads to DoS using persistent search
https://notcve.org/view.php?id=CVE-2018-10850
13 Jun 2018 — 389-ds-base before versions 1.4.0.10, 1.3.8.3 is vulnerable to a race condition in the way 389-ds-base handles persistent search, resulting in a crash if the server is under load. An anonymous attacker could use this flaw to trigger a denial of service. 389-ds-base en versiones anteriores a la 1.4.0.10 y 1.3.8.3 es vulnerable a una condición de carrera por la forma en la que 389-ds-base gestiona las búsquedas persistentes. Esto resulta en un cierre inesperado si el servidor está bajo carga. Un atacante anón... • http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00033.html • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 0CVE-2011-0704
https://notcve.org/view.php?id=CVE-2011-0704
04 May 2018 — 389 Directory Server 1.2.7.5, when built with mozldap, allows remote attackers to cause a denial of service (replica crash) by sending an empty modify request. 389 Directory Server 1.2.7.5, cuando se incluye con mozldap, permite que atacantes remotos provoquen una denegación de servicio (cierre inesperado de replica) mediante el envío de una petición modify vacía. • https://bugzilla.redhat.com/show_bug.cgi?id=675320 • CWE-20: Improper Input Validation •