p PatchFirst

CVE-2022-1949

CVE-2022-1949

This page contains facts from public vulnerability sources. Check the original advisory before updating.

An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would yield incorrect results, but as that has progressed, can be determined that it actually is an access control bypass. This may allow any remote unauthenticated user to issue a filter that allows searching for database items they do not have access to, including but not limited to potentially userPassword hashes and other sensitive data.

CVSS 7.5 · High · EPSS 1.5% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • 389-ds-base

    Versions
    • 389-ds-base-2.0: Affected

    No fix published

  • 389-ds-base Debian:12

    Affected ranges
    • ECOSYSTEM: < 2.3.1-1

    Update to 2.3.1-1

  • 389-ds-base Debian:13

    Affected ranges
    • ECOSYSTEM: < 2.3.1-1

    Update to 2.3.1-1

  • 389-ds-base Ubuntu:Pro:16.04:LTS

    Versions
    • 1.3.3.12-1build1
    • 1.3.3.13-1
    • 1.3.4.5-2
    • 1.3.4.8-1
    • 1.3.4.8-3
    • 1.3.4.8-3ubuntu1
    • 1.3.4.8-4
    • 1.3.4.9-1
    • 1.3.4.9-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • 389-ds-base Ubuntu:Pro:18.04:LTS

    Versions
    • 1.3.7.5-1
    • 1.3.7.5-1build1
    • 1.3.7.5-1build2
    • 1.3.7.9-1
    • 1.3.7.10-1
    • 1.3.7.10-1ubuntu1
    • 1.3.7.10-1ubuntu1+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • 389-ds-base Ubuntu:Pro:20.04:LTS

    Versions
    • 1.4.1.6-4
    • 1.4.1.6-4build1
    • 1.4.2.4-1
    • 1.4.2.4-1build1
    • 1.4.3.2-1
    • 1.4.3.2-1build1
    • 1.4.3.6-2
    • 1.4.3.6-2ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • 389-ds-base Ubuntu:22.04:LTS

    Versions
    • 1.4.4.11-2build1
    • 1.4.4.11-2build2
    • 1.4.4.17-1
    • 2.0.11-2
    • 2.0.14-1
    • 2.0.15-1
    • 2.0.15-1ubuntu2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • 389-ds-base Ubuntu:24.04:LTS

    Versions
    • 2.3.4+dfsg1-1
    • 2.4.4+dfsg1-1ubuntu1
    • 2.4.4+dfsg1-1ubuntu4
    • 2.4.4+dfsg1-3
    • 2.4.5+dfsg1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • 389-ds-base Ubuntu:25.10

    Versions
    • 3.1.2+dfsg1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • 389-ds-base Ubuntu:26.10

    Versions
    • 3.1.2+vendor1-2
    • 3.1.2+vendor1-2build1
    • 3.3.1-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • 389-ds-base Ubuntu:26.04:LTS

    Versions
    • 3.1.2+dfsg1-1
    • 3.1.2+vendor1-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →