REDHAT-BUG-2484802: Medium severity 389 Directory Server 389-ds-base vulnerability
389-ds-base security assessment finding 021 (2026-04-22).
Pre-auth LDAP filter injection in CleanAllRUV status-check extop (OID 2.16.840.1.113730.3.6.8). Handler multisupplierextopcleanruvcheckstatus() in replextop.c passes attacker-supplied filter unsanitized to internal cn=config search with replication plugin identity. No auth checks (unlike other replication extops).
With default nsslapd-allow-anonymous-access: on, anonymous bind suffices. Boolean oracle extracts 31 cn=config attributes (replication bind DN, password storage scheme, paths, ACI keywords). Password hashes not extractable via substring.
PoC confirmed: RHEL 7 (389-ds-base-1.3.11.1-5.el79), Fedora 42 (389-ds-base-3.1.4-6.fc42).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5). Red Hat impact: Moderate. CWE-90, CWE-306, CWE-20.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable anonymous access (set nsslapd-allow-anonymous-access to off) so an anonymous bind cannot perform the CleanAllRUV status-check extop that is vulnerable to pre-auth LDAP filter injection.
389-ds-base (nsslapd) nsslapd-allow-anonymous-access = off - Compensating control
Restrict network access to the LDAP/389 Directory Server ports (where the vulnerable CleanAllRUV status-check extop can be invoked) so only trusted clients can reach it, reducing the ability to exploit the pre-auth LDAP filter injection.
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2484802?
The severity of REDHAT-BUG-2484802 is rated as medium with a score of 4.
What type of vulnerability is documented in REDHAT-BUG-2484802?
REDHAT-BUG-2484802 describes a pre-auth LDAP filter injection vulnerability.
How do I fix REDHAT-BUG-2484802?
To fix REDHAT-BUG-2484802, you need to update to the latest version of the 389 Directory Server package that addresses this vulnerability.
Which software is affected by REDHAT-BUG-2484802?
The affected software for REDHAT-BUG-2484802 is 389 Directory Server 389-ds-base.
What is the impact of REDHAT-BUG-2484802?
The impact of REDHAT-BUG-2484802 includes potential unauthorized access through LDAP filter injection.