CVE-2022-0996: Medium severity red hat 389 directory server vulnerability
a user whose password was expired was still allowed to access the database as if the password was not expired. Once a password is expired, and "grace logins" have been used up, the account is basically supposed to be locked out and should not be allowed to perform any privileged action.
Other sources
A vulnerability was found in the 389 Directory Server that allows expired passwords to access the database to cause improper authentication.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-0996?
CVE-2022-0996 is a vulnerability found in the 389 Directory Server that allows expired passwords to access the database to Cause Improper Authentication.
How severe is CVE-2022-0996?
CVE-2022-0996 has a severity rating of 6.5 (medium).
Which software is affected by CVE-2022-0996?
The affected software includes Redhat 389 Directory Server version 1.4.0.0, Fedoraproject Fedora versions 34 and 35, and Redhat Enterprise Linux version 8.0.
How can I fix CVE-2022-0996?
To fix CVE-2022-0996, you should apply the necessary updates and patches provided by the software vendor.
Where can I find more information about CVE-2022-0996?
You can find more information about CVE-2022-0996 in the following references: [Reference 1](https://bugzilla.redhat.com/show_bug.cgi?id=2064769), [Reference 2](https://github.com/ByteHackr/389-ds-base), [Reference 3](https://lists.debian.org/debian-lts-announce/2023/04/msg00026.html).