Information Exposure Affecting 389-ds-base-snmp package, versions <0:1.4.3.8-7.module+el8.3.0+10310+6e88d919


Severity

Recommended
0.0
medium
0
10

Based on CentOS security rating

    Threat Intelligence

    EPSS
    0.11% (46th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-CENTOS8-389DSBASESNMP-2092120
  • published 26 Jul 2021
  • disclosed 7 Dec 2020

How to fix?

Upgrade Centos:8 389-ds-base-snmp to version 0:1.4.3.8-7.module+el8.3.0+10310+6e88d919 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream 389-ds-base-snmp package and not the 389-ds-base-snmp package as distributed by Centos. See How to fix? for Centos:8 relevant fixed versions and status.

When binding against a DN during authentication, the reply from 389-ds-base will be different whether the DN exists or not. This can be used by an unauthenticated attacker to check the existence of an entry in the LDAP database.

CVSS Scores

version 3.1
Expand this section

NVD

5.3 medium
  • Attack Vector (AV)
    Network
  • Attack Complexity (AC)
    Low
  • Privileges Required (PR)
    None
  • User Interaction (UI)
    None
  • Scope (S)
    Unchanged
  • Confidentiality (C)
    Low
  • Integrity (I)
    None
  • Availability (A)
    None
Expand this section

Red Hat

5.3 medium
Expand this section

SUSE

5.3 medium