NVD Vulnerability Detail

CVE-2020-35518

Summary	When binding against a DN during authentication, the reply from 389-ds-base will be different whether the DN exists or not. This can be used by an unauthenticated attacker to check the existence of an entry in the LDAP database.
Publication Date	March 27, 2021, 2:15 a.m.
Registration Date	March 27, 2021, 12:01 p.m.
Last Update	Nov. 21, 2024, 2:27 p.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:o:redhat:389_directory_server::::::::	2.0.0			2.0.3
cpe:2.3:o:redhat:389_directory_server::::::::	1.4.4.0			1.4.4.13
cpe:2.3:o:redhat:389_directory_server::::::::				1.4.3.19

Configuration2	or higher	or less	more than	less than
cpe:2.3:o:redhat:enterprise_linux:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux:8.0:::::::*
cpe:2.3:a:redhat:directory_server:11.0:::::::*

Related information, measures and tools

No	URL	タグ
1	https://bugzilla.redhat.com/show_bug.cgi?id=1905565	Issue Tracking Patch Vendor Advisory
2	https://bugzilla.redhat.com/show_bug.cgi?id=1905565	Issue Tracking Patch Vendor Advisory
3	https://github.com/389ds/389-ds-base/commit/b6aae4d8e7c8a6ddd21646f94fef1bf7f22c3f32	Patch Third Party Advisory
4	https://github.com/389ds/389-ds-base/commit/b6aae4d8e7c8a6ddd21646f94fef1bf7f22c3f32	Patch Third Party Advisory
5	https://github.com/389ds/389-ds-base/commit/cc0f69283abc082488824702dae485b8eae938bc	Patch Third Party Advisory
6	https://github.com/389ds/389-ds-base/commit/cc0f69283abc082488824702dae485b8eae938bc	Patch Third Party Advisory
7	https://github.com/389ds/389-ds-base/issues/4480	Patch Third Party Advisory
8	https://github.com/389ds/389-ds-base/issues/4480	Patch Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-203	セキュリティ関連の処理に対するレスポンスの違いに起因する情報漏えい	https://cwe.mitre.org/data/definitions/203.html

JVN Vulnerability Information

389-ds-base における情報漏えいに関する脆弱性

Title	389-ds-base における情報漏えいに関する脆弱性
Summary	389-ds-base には、情報漏えいに関する脆弱性が存在します。
Possible impacts	情報を取得される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Dec. 8, 2020, midnight
Registration Date	Dec. 2, 2021, 6:03 p.m.
Last Update	Dec. 2, 2021, 6:03 p.m.

Affected System

レッドハット

389 Directory Server

Red Hat Directory Server

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2020-35518	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-35518
National Vulnerability Database (NVD)
2	CVE-2020-35518	https://nvd.nist.gov/vuln/detail/CVE-2020-35518

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-200	https://jvndb.jvn.jp/ja/cwe/CWE-200.html

ベンダー情報

No	Name	URL
GitHub
1	Issue 4480 - Unexpected info returned to ldap request (#4491)	https://github.com/389ds/389-ds-base/commit/cc0f69283abc082488824702dae485b8eae938bc
2	Issue 4609 - CVE - info disclosure when authenticating	https://github.com/389ds/389-ds-base/commit/b6aae4d8e7c8a6ddd21646f94fef1bf7f22c3f32
3	Unexpected info returned to ldap request #4480	https://github.com/389ds/389-ds-base/issues/4480
Red Hat Bugzilla
4	Bug 1905565	https://bugzilla.redhat.com/show_bug.cgi?id=1905565

Change Log

No	Changed Details	Date of change
1	[2021年12月02日] 掲載	Dec. 2, 2021, 6:03 p.m.