PT-2020-6873 · Unknown+6 · 389-Ds-Base+6

Cedric Buissart · Published 2020-12-08 · Updated 2024-07-29 · CVE-2020-35518

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions 389-ds-base (affected versions not specified)

Description The issue allows an unauthenticated attacker to check the existence of an entry in the LDAP database by exploiting the different replies from 389-ds-base when binding against a DN during authentication. This can lead to the disclosure of information and potentially allow a remote attacker to access confidential data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Side Channel Attack

Weakness Enumeration

CWE-200

CWE-203

Related Identifiers

BDU:2023-02645

CESA-2021_1086

CESA-2021_2323

CVE-2020-35518

OESA-2022-1602

OESA-2022-2056

OPENSUSE-SU-2021:0418-1

OPENSUSE-SU-2021_0418-1

RHSA-2021:0599

RHSA-2021:1086

RHSA-2021:1243

RHSA-2021:1258

RHSA-2021:2323

RHSA-2021_1086

RHSA-2021_2323

SUSE-SU-2021:0724-1

SUSE-SU-2021_0724-1

USN-5231-1

Affected Products

389-Ds-Base

Astra Linux

Centos

Linuxmint

Red Hat

Suse

Ubuntu

References · 33

• https://github.com/389ds/389-ds-base/issues/4480 · Patch
• https://github.com/389ds/389-ds-base/commit/cc0f69283abc082488824702dae485b8eae938bc · Patch
• https://github.com/389ds/389-ds-base/commit/b6aae4d8e7c8a6ddd21646f94fef1bf7f22c3f32 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-35518 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1905565 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:0724-1 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2021-2323.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-35518 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-35518 · Security Note
• https://osv.dev/vulnerability/USN-5231-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-02645 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-35518 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2022-1602 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2022-2056 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2021-1086.html · Vendor Advisory