p PatchFirst

CVE-2020-35518

CVE-2020-35518

This page contains facts from public vulnerability sources. Check the original advisory before updating.

When binding against a DN during authentication, the reply from 389-ds-base will be different whether the DN exists or not. This can be used by an unauthenticated attacker to check the existence of an entry in the LDAP database.

CVSS 5.3 · Medium · EPSS 1.5% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • 389-ds-base

    Versions
    • 389-ds-base 2.0.3, 389-ds-base 1.4.4.13, 389-ds-base 1.4.3.19: Affected

    No fix published

  • 389-ds-base Debian:12

    Affected ranges
    • ECOSYSTEM: < 1.4.4.10-1

    Update to 1.4.4.10-1

  • 389-ds-base Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.4.4.10-1

    Update to 1.4.4.10-1

  • 389-ds-base Ubuntu:Pro:20.04:LTS

    Versions
    • 1.4.1.6-4
    • 1.4.1.6-4build1
    • 1.4.2.4-1
    • 1.4.2.4-1build1
    • 1.4.3.2-1
    • 1.4.3.2-1build1
    • 1.4.3.6-2
    Affected ranges
    • ECOSYSTEM: < 1.4.3.6-2ubuntu0.1~esm1

    Update to 1.4.3.6-2ubuntu0.1~esm1

Original sources

Check your server →