Düşük CVSS 3.7
CVE-2026-15041: Directory Server: güvenlik açığı
Açıklama (NVD)
A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password verification function uses standard memcmp() for comparing password hashes instead of a constant-time comparison function. A remote attacker could potentially use timing measurements of LDAP bind attempts to infer partial hash information, though practical exploitation is extremely difficult due to PBKDF2 computational overhead.
Özet bilgiler
- Ürün
- Redhat Directory Server
- CVSS v3.1
- 3.7
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - CWE
- CWE-208
- Yama
- Yok / bilinmiyor
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| redhat-directory-server | 11.0 | 11.0 | — |
| redhat-directory-server | 12.0 | 12.0 | — |
| redhat-directory-server | 13.0 | 13.0 | — |
| redhat-389-directory-server | — | — | — |
| redhat-enterprise-linux | 7.0 | 7.0 | — |
| redhat-enterprise-linux | 8.0 | 8.0 | — |
| redhat-enterprise-linux | 9.0 | 9.0 | — |
| redhat-enterprise-linux | 10.0 | 10.0 | — |