When binding against a DN during authentication, the reply from 389-ds-base will be different whether the DN exists or not. This can be used by an unauthenticated attacker to check the existence of an entry in the LDAP database.
References
| Link | Resource |
|---|---|
| https://bugzilla.redhat.com/show_bug.cgi?id=1905565 | Issue Tracking Patch Vendor Advisory |
| https://github.com/389ds/389-ds-base/commit/b6aae4d8e7c8a6ddd21646f94fef1bf7f22c3f32 | Patch Third Party Advisory |
| https://github.com/389ds/389-ds-base/commit/cc0f69283abc082488824702dae485b8eae938bc | Patch Third Party Advisory |
| https://github.com/389ds/389-ds-base/issues/4480 | Patch Third Party Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
History
05 Aug 2022, 17:42
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-203 |
01 Apr 2021, 14:56
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:directory_server:11.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:389_directory_server:*:*:*:*:*:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : 5.0
v3 : 5.3 |
| References | (MISC) https://github.com/389ds/389-ds-base/commit/cc0f69283abc082488824702dae485b8eae938bc - Patch, Third Party Advisory | |
| References | (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=1905565 - Issue Tracking, Patch, Vendor Advisory | |
| References | (MISC) https://github.com/389ds/389-ds-base/commit/b6aae4d8e7c8a6ddd21646f94fef1bf7f22c3f32 - Patch, Third Party Advisory | |
| References | (MISC) https://github.com/389ds/389-ds-base/issues/4480 - Patch, Third Party Advisory |
26 Mar 2021, 17:18
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-03-26 17:15
Updated : 2023-12-10 13:55
NVD link : CVE-2020-35518
Mitre link : CVE-2020-35518
CVE.ORG link : CVE-2020-35518
JSON object : View
Products Affected
redhat
- directory_server
- enterprise_linux
- 389_directory_server