Read the docs
TI-2020-18037 Aliases CVE-2020-35518GHSA-vg4h-9m5m-rchq

Information disclosure in 389-ds-base

Priority LOW 27CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Partial Red Hat: 10 fixed, 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-200.

Summary

When binding against a DN during authentication, the reply from 389-ds-base will be different whether the DN exists or not. This can be used by an unauthenticated attacker to check the existence of an entry in the LDAP database.

Why it matters now

EPSS 0.01538 75th percentileScored 2026-11-07
Fix Partial Red Hat: 5 advisoriesRed Hat: 10 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—389-ds-base389-ds-base 2.0.3, 389-ds-base 1.4.4.13, 389-ds-base 1.4.3.19—No fix listedCNA
  • 389-ds-base Vendor— Affected 389-ds-base 2.0.3, 389-ds-base 1.4.4.13, 389-ds-base 1.4.3.19 Fixed in — No fix listed CNA

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:o:redhat:389_directory_server:*:*:*:*:*:*:*:*before 1.4.3.19; 1.4.4.0 to before 1.4.4.13; 2.0.0 to before 2.0.3VulnerableRed Hat
cpe:2.3:a:redhat:directory_server:11.0:*:*:*:*:*:*:*11.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*8.0VulnerableRed Hat
  • cpe:2.3:o:redhat:389_directory_server:*:*:*:*:*:*:*:* Versions before 1.4.3.19; 1.4.4.0 to before 1.4.4.13; 2.0.0 to before 2.0.3 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:directory_server:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat

Remediation

Red Hat 5 advisories

  • RHSA-2021:2323 Released 2021-06-08 · Red Hat rating Moderate
    389-ds-base security and bug fix update
    • Red Hat Enterprise Linux Client Optional (v. 7) 389-ds-base-1.3.10.2-12.el7_9, 389-ds-base-devel-1.3.10.2-12.el7_9, 389-ds-base-libs-1.3.10.2-12.el7_9 +1
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) 389-ds-base-1.3.10.2-12.el7_9, 389-ds-base-devel-1.3.10.2-12.el7_9, 389-ds-base-libs-1.3.10.2-12.el7_9 +1
    • Red Hat Enterprise Linux Server (v. 7) 389-ds-base-1.3.10.2-12.el7_9, 389-ds-base-libs-1.3.10.2-12.el7_9
    • Red Hat Enterprise Linux Server Optional (v. 7) 389-ds-base-1.3.10.2-12.el7_9, 389-ds-base-devel-1.3.10.2-12.el7_9, 389-ds-base-libs-1.3.10.2-12.el7_9 +1
    • Red Hat Enterprise Linux Workstation (v. 7) 389-ds-base-1.3.10.2-12.el7_9, 389-ds-base-libs-1.3.10.2-12.el7_9
    • Red Hat Enterprise Linux Workstation Optional (v. 7) 389-ds-base-devel-1.3.10.2-12.el7_9, 389-ds-base-snmp-1.3.10.2-12.el7_9
  • RHSA-2021:1258 Released 2021-04-19 · Red Hat rating Moderate
    389-ds:1.4 security and bug fix update
    • Red Hat Enterprise Linux AppStream EUS (v. 8.2) 389-ds-base-1.4.2.4-13.module+el8.2.0+10648+abe88955.aarch64::389-ds:1.4, 389-ds-base-1.4.2.4-13.module+el8.2.0+10648+abe88955.ppc64le::389-ds:1.4, 389-ds-base-1.4.2.4-13.module+el8.2.0+10648+abe88955.s390x::389-ds:1.4 +19
  • RHSA-2021:1243 Released 2021-04-19 · Red Hat rating Moderate
    redhat-ds:11 security and bug fix update
    • Red Hat Directory Server 11.2 for RHEL 8 389-ds-base-1.4.3.21-3.module+el8dsrv+10401+3d549418.src::redhat-ds:11, 389-ds-base-1.4.3.21-3.module+el8dsrv+10401+3d549418.x86_64::redhat-ds:11, 389-ds-base-devel-1.4.3.21-3.module+el8dsrv+10401+3d549418.x86_64::redhat-ds:11 +5
Show 2 more Red Hat advisories
  • RHSA-2021:1086 Released 2021-04-06 · Red Hat rating Moderate
    389-ds:1.4 security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 8) 389-ds-base-1.4.3.8-7.module+el8.3.0+10310+6e88d919.aarch64::389-ds:1.4, 389-ds-base-1.4.3.8-7.module+el8.3.0+10310+6e88d919.ppc64le::389-ds:1.4, 389-ds-base-1.4.3.8-7.module+el8.3.0+10310+6e88d919.s390x::389-ds:1.4 +19
  • RHSA-2021:0599 Released 2021-02-16 · Red Hat rating Moderate
    redhat-ds:11 security and bug fix update
    • Red Hat Directory Server 11.1 for RHEL 8 389-ds-base-1.4.2.12-5.module+el8dsrv+9896+eb95346c.src::redhat-ds:11, 389-ds-base-1.4.2.12-5.module+el8dsrv+9896+eb95346c.x86_64::redhat-ds:11, 389-ds-base-devel-1.4.2.12-5.module+el8dsrv+9896+eb95346c.x86_64::redhat-ds:11 +5

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Directory Server 11.1 for RHEL 8Fixed RHSA-2021:0599
Red Hat Directory Server 11.2 for RHEL 8Fixed RHSA-2021:1243
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2021:1086
Red Hat Enterprise Linux AppStream EUS (v. 8.2)Fixed RHSA-2021:1258
Red Hat Enterprise Linux Client Optional (v. 7)Fixed RHSA-2021:2323
Red Hat Enterprise Linux ComputeNode Optional (v. 7)Fixed RHSA-2021:2323
Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2021:2323
Red Hat Enterprise Linux Server Optional (v. 7)Fixed RHSA-2021:2323
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2021:2323
Red Hat Enterprise Linux Workstation Optional (v. 7)Fixed RHSA-2021:2323
Not affected: 1 product
  • Red Hat Enterprise Linux 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-35518
  2. 2026-10-03 Alias added: GHSA-vg4h-9m5m-rchq

References

Patch 4

  • TI-2026-13229 Stack-based buffer overflow in Red Hat Directory Server 11.5 E4S for RHEL 8 CVSS 3.1HIGH 7.5
  • TI-2026-07965 Resource allocation without limits in 389-ds-base CVSS 3.1HIGH 7.5
  • TI-2026-10157 389-ds-base: 389-ds-base: pre-auth ldap filter injection in cleanallruv status check CVSS 3.1HIGH 7.5
  • TI-2024-05784 389-ds-base: unauthenticated user can trigger a dos by sending a specific extended search request CVSS 3.1MEDIUM 6.5
  • TI-2022-01808 Authorization bypass in 389-ds-base CVSS 3.1HIGH 7.5
  • TI-2010-02131 NULL pointer dereference in Red Hat Directory Server CVSS 3.1HIGH 7.5
See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences