UbuntuUSN-5231-1389 Directory Server vulnerabilities
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
5.9 Medium
AI Score
Confidence
High
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
0.001 Low
EPSS
Percentile
44.1%
Releases
- Ubuntu 20.04 LTS
- Ubuntu 18.04 ESM
- Ubuntu 16.04 ESM
Packages
- 389-ds-base - 389 Directory Server suite - server
Details
It was discovered that 389 Directory Server presented to users, during
authentication, an error message which could be used to discover if a
certain LDAP DN existed or not. A remote unauthenticated attacker could
possibly use this to check the existence of an entry in a LDAP database
and expose sensitive information. This issue affected only Ubuntu 20.04
ESM. (CVE-2020-35518)
It was discovered that 389 Directory Server was incorrectly validating
data used to access memory addresses. An authenticated attacker using a
Syncrepl client could use this issue with a specially crafted query to
cause 389 Directory Server to crash, resulting in a denial of service.
(CVE-2021-3514)
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Ubuntu | 20.04 | noarch | 389-ds-base | < 1.4.3.6-2ubuntu0.1~esm1 | UNKNOWN |
| Ubuntu | 20.04 | noarch | 389-ds | < 1.4.3.6-2 | UNKNOWN |
| Ubuntu | 20.04 | noarch | 389-ds-base | < 1.4.3.6-2 | UNKNOWN |
| Ubuntu | 20.04 | noarch | 389-ds-base-dbgsym | < 1.4.3.6-2 | UNKNOWN |
| Ubuntu | 20.04 | noarch | 389-ds-base-dev | < 1.4.3.6-2 | UNKNOWN |
| Ubuntu | 20.04 | noarch | 389-ds-base-libs | < 1.4.3.6-2 | UNKNOWN |
| Ubuntu | 20.04 | noarch | 389-ds-base-libs-dbgsym | < 1.4.3.6-2 | UNKNOWN |
| Ubuntu | 20.04 | noarch | cockpit-389-ds | < 1.4.3.6-2 | UNKNOWN |
| Ubuntu | 20.04 | noarch | python3-lib389 | < 1.4.3.6-2 | UNKNOWN |
| Ubuntu | 18.04 | noarch | 389-ds-base | < 1.3.7.10-1ubuntu1+esm1 | UNKNOWN |
Related
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
5.9 Medium
AI Score
Confidence
High
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
0.001 Low
EPSS
Percentile
44.1%