REDHAT-BUG-1747448: High severity 389 directory server vulnerability

Published Aug 30, 2019
·
Updated

A vulnerability was found in 389-ds-base : the deref plugin is checking for either READ or SEARCH permission for dereferencing an attribute. This means that the SEARCH permission is sufficient to display an attribute via the plugin.

This is relevant in particular in IdM/IPA environment, where a default ACI ("Search existence of password and kerberos keys") in set. This leads to dereferencing able to display userPassword content or any users.

Affected Software

1 affected component
389 Project 389 Directory Server

Event History

Aug 30, 2019
Data Sourced
via Red Hat·01:12 PM
DescriptionSeverityAffected Software
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of REDHAT-BUG-1747448?

The severity of REDHAT-BUG-1747448 is considered moderate due to its potential impact on sensitive attribute visibility.

2

How do I fix REDHAT-BUG-1747448?

To fix REDHAT-BUG-1747448, update your 389 Directory Server to the latest version that addresses this vulnerability.

3

What software is affected by REDHAT-BUG-1747448?

REDHAT-BUG-1747448 affects the 389 Directory Server software.

4

What does REDHAT-BUG-1747448 involve?

REDHAT-BUG-1747448 involves a vulnerability in the deref plugin that improperly checks permissions for dereferencing attributes.

5

Can the vulnerability REDHAT-BUG-1747448 lead to unauthorized data exposure?

Yes, REDHAT-BUG-1747448 can lead to unauthorized exposure of attributes if adequate permissions are not enforced.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203
REDHAT-BUG-1747448 - High severity 389 directory server vulnerability - SecAlerts