CVE-2026-14969Medium· 4.4▾ SunlitA flaw was found in 389-ds-base where the LDBM backend attribute encryption uses a hardcoded static initialization vector for AES-CBC and 3DES-CBC operations, allowing an attacker with privileged filesystem access to detect plaintext equ…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 24.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.1%
A flaw was found in 389-ds-base where the LDBM backend attribute encryption uses a hardcoded static initialization vector for AES-CBC and 3DES-CBC operations, allowing an attacker with privileged filesystem access to detect plaintext equality across encrypted entries by comparing ciphertext blocks.
redhat-ds:11/389-ds-base (all versions)redhat-ds:12/389-ds-base (all versions)389-ds-base (all versions)389-ds-base (all versions)389-ds-base389-ds-base (all versions)389-ds:1.4/389-ds-base (all versions)389-ds-base (all versions)Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Disable attribute encryption if it is not required for the deployment. If attribute encryption is required, restrict filesystem access to the LDBM database directory (/var/lib/dirsrv/slapd-<instance>/db/) to ensure only authorized administrators can read database files.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-18663Medium· 5.9389-ds-base: 389-ds-base: pre-authentication double-free in get_ldapmessage_controls_ext() via critical session tracking control
CVE-2026-16560Medium· 5.3389-ds-base: 389-ds-base: heap-buffer-overflow in rdn_av_swap on quoted multivalued rdn
CVE-2026-14940Medium· 5.3389-ds-base: 389-ds-base: heap-buffer-overflow in dn normalization via quoted multivalued rdn
CVE-2026-11884Medium· 6.5389-ds-base: 389-ds-base: heap buffer overflow in schema objectclass serialization due to missing oc_superior in size calculation
CVE-2026-11789Medium· 4.9389-ds-base: 389-ds-base: smd5 password storage plugin salt length integer underflow crash
CVE-2026-11790Medium· 4.9389-ds-base: 389-ds-base: pbkdf2 password storage plugin unbounded iteration count denial of service