A flaw was found in 389-ds-base. If an asterisk is imported as password hashes, either accidentally or maliciously, then instead of being inactive, any password will successfully match during authentication. This flaw allows an attacker to successfully authenticate as a user whose password was disabled.
References
| Link | Resource |
|---|---|
| https://bugzilla.redhat.com/show_bug.cgi?id=1982782 | Issue Tracking Third Party Advisory |
| https://github.com/389ds/389-ds-base/issues/4817 | Patch Third Party Advisory |
| https://lists.debian.org/debian-lts-announce/2023/04/msg00026.html |
Configurations
History
24 Apr 2023, 09:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
28 Nov 2022, 19:54
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : 6.4
v3 : 6.5 |
27 Oct 2022, 11:55
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | NVD-CWE-Other |
27 Apr 2022, 03:15
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:port389:389-ds-base:*:*:*:*:*:*:*:* | |
| CWE | CWE-287 | |
| References | (MISC) https://github.com/389ds/389-ds-base/issues/4817 - Patch, Third Party Advisory | |
| References | (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=1982782 - Issue Tracking, Third Party Advisory | |
| CVSS |
v2 : v3 : |
v2 : 7.5
v3 : 9.8 |
| First Time |
Port389
Port389 389-ds-base |
18 Apr 2022, 17:45
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-04-18 17:15
Updated : 2023-12-10 14:22
NVD link : CVE-2021-3652
Mitre link : CVE-2021-3652
CVE.ORG link : CVE-2021-3652
JSON object : View
Products Affected
port389
- 389-ds-base
CWE