CVE-2020-35518

Опубликовано: 26 мар. 2021

Источник: nvd

CVSS3: 5.3

CVSS2: 5

EPSS Низкий

Описание

When binding against a DN during authentication, the reply from 389-ds-base will be different whether the DN exists or not. This can be used by an unauthenticated attacker to check the existence of an entry in the LDAP database.

Ссылки

https://bugzilla.redhat.com/show_bug.cgi?id=1905565
Issue Tracking
Patch
Vendor Advisory
https://github.com/389ds/389-ds-base/commit/b6aae4d8e7c8a6ddd21646f94fef1bf7f22c3f32
Patch
Third Party Advisory
https://github.com/389ds/389-ds-base/commit/cc0f69283abc082488824702dae485b8eae938bc
Patch
Third Party Advisory
https://github.com/389ds/389-ds-base/issues/4480
Patch
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1905565
Issue Tracking
Patch
Vendor Advisory
https://github.com/389ds/389-ds-base/commit/b6aae4d8e7c8a6ddd21646f94fef1bf7f22c3f32
Patch
Third Party Advisory
https://github.com/389ds/389-ds-base/commit/cc0f69283abc082488824702dae485b8eae938bc
Patch
Third Party Advisory
https://github.com/389ds/389-ds-base/issues/4480
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:o:redhat:389_directory_server:*:*:*:*:*:*:*:*

Версия до 1.4.3.19 (исключая)

cpe:2.3:o:redhat:389_directory_server:*:*:*:*:*:*:*:*

Версия от 1.4.4.0 (включая) до 1.4.4.13 (исключая)

cpe:2.3:o:redhat:389_directory_server:*:*:*:*:*:*:*:*

Версия от 2.0.0 (включая) до 2.0.3 (исключая)

Конфигурация 2

Одно из

cpe:2.3:a:redhat:directory_server:11.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*

EPSS

Процентиль: 74%

0.00801

Низкий

5.3 Medium

CVSS3

5 Medium

CVSS2

Дефекты

CWE-200

CWE-203

Связанные уязвимости

CVE-2020-35518

CVSS3: 5.3

ubuntu

почти 5 лет назад

CVE-2020-35518

CVSS3: 5.3

redhat

около 5 лет назад

CVE-2020-35518

CVSS3: 5.3

debian

почти 5 лет назад

When binding against a DN during authentication, the reply from 389-ds ...

openSUSE-SU-2021:0418-1

suse-cvrf

почти 5 лет назад

Security update for 389-ds

SUSE-SU-2021:0724-1

suse-cvrf

почти 5 лет назад

Security update for 389-ds

EPSS

Процентиль: 74%

0.00801

Низкий

5.3 Medium

CVSS3

5 Medium

CVSS2

Дефекты

CWE-200

CWE-203