Описание
A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler performs the search against cn=config with elevated replication plugin privileges and returns a boolean match result, the attacker can extract sensitive server configuration metadata, including replication bind DNs and password storage scheme information.
Отчет
A Moderate impact information disclosure flaw was found in 389 Directory Server. An unauthenticated remote attacker can exploit an LDAP filter injection vulnerability in the CleanAllRUV status-check extended operation. Red Hat products with nsslapd-allow-anonymous-access enabled by default are particularly susceptible.
Меры по смягчению последствий
Set nsslapd-allow-anonymous-access to rootdse or off. Restrict LDAP ports to trusted networks. Monitor for extop OID 2.16.840.1.113730.3.6.8. Use strong replication manager passwords.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Directory Server 12 | redhat-ds:12/389-ds-base | Affected | ||
| Red Hat Directory Server 13 | 389-ds-base | Affected | ||
| Red Hat Enterprise Linux 6 | 389-ds-base | Out of support scope | ||
| Red Hat Enterprise Linux 7 | 389-ds-base | Affected | ||
| Red Hat Enterprise Linux 8 | 389-ds-base | Affected | ||
| Red Hat Directory Server 11.9 for RHEL 8 | redhat-ds | Fixed | RHSA-2026:55532 | 17.08.2026 |
| Red Hat Enterprise Linux 10 | 389-ds-base | Fixed | RHSA-2026:55424 | 17.08.2026 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | 389-ds-base | Fixed | RHSA-2026:55425 | 17.08.2026 |
| Red Hat Enterprise Linux 9 | 389-ds-base | Fixed | RHSA-2026:55423 | 17.08.2026 |
| Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | 389-ds-base | Fixed | RHSA-2026:55421 | 17.08.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler performs the search against cn=config with elevated replication plugin privileges and returns a boolean match result, the attacker can extract sensitive server configuration metadata, including replication bind DNs and password storage scheme information.
A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler performs the search against cn=config with elevated replication plugin privileges and returns a boolean match result, the attacker can extract sensitive server configuration metadata, including replication bind DNs and password storage scheme information.
A flaw was found in 389 Directory Server. An unauthenticated remote at ...
A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler performs the search against cn=config with elevated replication plugin privileges and returns a boolean match result, the attacker can extract sensitive server configuration metadata, including replication bind DNs and password storage scheme information.
EPSS
7.5 High
CVSS3