Total vulnerabilities in the database
When binding against a DN during authentication, the reply from 389-ds-base will be different whether the DN exists or not. This can be used by an unauthenticated attacker to check the existence of an entry in the LDAP database.
| Software | From | Fixed in |
|---|---|---|
| redhat / 389_directory_server | 2.0.0 | 2.0.3 |
| redhat / 389_directory_server | 1.4.4.0 | 1.4.4.13 |
| redhat / 389_directory_server | - | 1.4.3.19 |
| redhat / enterprise_linux | 7.0 | 7.0.x |
| redhat / enterprise_linux | 8.0 | 8.0.x |
| redhat / directory_server | 11.0 | 11.0.x |