CVE-2021-3652
First published: Thu Jul 15 2021(Updated: )
A flaw was found in 389-ds-base. If an asterisk is imported as password hashes, either accidentally or maliciously, then instead of being inactive, any password will successfully match during authentication. This flaw allows an attacker to successfully authenticate as a user whose password was disabled.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Port389 389-ds-base | <2.0.7 | |
| redhat/389-ds-base | <2.0.7 | 2.0.7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi?id=1982782
- https://github.com/389ds/389-ds-base/issues/4817
- https://lists.debian.org/debian-lts-announce/2023/04/msg00026.html
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1982786
- https://github.com/389ds/389-ds-base/commit/aeb90eb0c41fc48541d983f323c627b2e6c328c7
- https://access.redhat.com/errata/RHSA-2021:3079
- https://access.redhat.com/security/cve/cve-2021-3652
- https://access.redhat.com/errata/RHSA-2021:3807
- https://access.redhat.com/errata/RHSA-2021:3906
- https://access.redhat.com/errata/RHSA-2021:3955
Frequently Asked Questions
What is CVE-2021-3652?
CVE-2021-3652 is a vulnerability found in 389-ds-base that allows an attacker to successfully authenticate as a user whose password was disabled.
How severe is CVE-2021-3652?
CVE-2021-3652 has a severity value of 6.5 (Medium).
What is affected by CVE-2021-3652?
389-ds-base version 2.0.7 is affected by CVE-2021-3652.
How can I fix CVE-2021-3652?
To fix CVE-2021-3652, update 389-ds-base to version 2.0.8 or later.
Where can I find more information about CVE-2021-3652?
More information about CVE-2021-3652 can be found on Red Hat Bugzilla, GitHub, and Debian LTS Announce.
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/remedy
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/type
- agent/weakness
- collector/nvd-index
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2021-3652
- agent/software-canonical-lookup
- vendor/port389
- canonical/port389 389-ds-base
- package-manager/redhat