Attestkeep
Idioma: Español
Registrarse

Vulnerabilidades / CVE-2026-18922

crítica

CVE-2026-18922

389-ds-base: 389-ds-base: SASL PLAIN authentication allows privilege escalation to Directory Manager via stale identity in Cyrus SASL auxiliary property

Publicada Modificada CWE 287
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.

Severidad por fuente

Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

La etiqueta propia de Trivy es CRITICAL. Crítica según Red Hat, AlmaLinux, Amazon, Oracle, Rocky Linux.

Descripción

A flaw was found in 389 Directory Server. During SASL PLAIN authentication, a stale identity carried in a Cyrus SASL auxiliary property from a prior failed bind attempt can be installed on a connection following a subsequent, unrelated successful bind, regardless of which SASL mechanism completes that second bind. An attacker can send a SASL PLAIN bind as cn=Directory Manager with an incorrect password, then complete a SASL ANONYMOUS bind on the same connection, causing the server to grant Directory Manager authority without any valid credentials. A variant using a valid low-privileged account's own successful bind instead of an anonymous one is also possible.

Paquetes afectados y versiones corregidas

FuentePaqueteCorregido en
alma 10389-ds-base, 389-ds-base-bdb, 389-ds-base-devel y 3 más3.2.0-10.el10_2
alma 8389-ds:1.4::389-ds-base, 389-ds:1.4::389-ds-base-devel, 389-ds:1.4::389-ds-base-legacy-tools y 3 más1.4.3.39-28.module_el8.10.0+4274+00f9a3f1
alma 9389-ds-base, 389-ds-base-devel, 389-ds-base-libs y 2 más2.8.0-10.el9_8
amazon linux 2389-ds-base, 389-ds-base-debuginfo, 389-ds-base-devel y 2 más1.3.10.2-17.amzn2.0.9
Oracle Linux 7389-ds-base, 389-ds-base-devel, 389-ds-base-libs y 1 más1.3.11.1-5.0.15.el7_9
Oracle Linux 8389-ds-base, 389-ds-base-devel, 389-ds-base-legacy-tools y 3 más1.4.3.39-28.module+el8.10.0+91024+7bf29691
Oracle Linux 9389-ds-base, 389-ds-base-devel, 389-ds-base-libs y 2 más2.8.0-10.el9_8
rocky 10389-ds-base, 389-ds-base-libs, 389-ds-base-snmp y 1 más3.2.0-10.el10_2
rocky 8389-ds:1.4::389-ds-base, 389-ds:1.4::389-ds-base-devel, 389-ds:1.4::389-ds-base-legacy-tools y 3 más1.4.3.39-28.module+el8.10.0+40311+cd962df1
rocky 9389-ds-base, 389-ds-base-libs, 389-ds-base-snmp y 1 más2.8.0-10.el9_8
debian 11389-ds-basesin corrección indicada
debian 12389-ds-basesin corrección indicada
Mostrar las 78 entradas de 21 fuentes
FuentePaqueteCorregido en
alma 10389-ds-base3.2.0-10.el10_2
alma 10389-ds-base-bdb3.2.0-10.el10_2
alma 10389-ds-base-devel3.2.0-10.el10_2
alma 10389-ds-base-libs3.2.0-10.el10_2
alma 10389-ds-base-snmp3.2.0-10.el10_2
alma 10python3-lib3893.2.0-10.el10_2
alma 8389-ds:1.4::389-ds-base1.4.3.39-28.module_el8.10.0+4274+00f9a3f1
alma 8389-ds:1.4::389-ds-base-devel1.4.3.39-28.module_el8.10.0+4274+00f9a3f1
alma 8389-ds:1.4::389-ds-base-legacy-tools1.4.3.39-28.module_el8.10.0+4274+00f9a3f1
alma 8389-ds:1.4::389-ds-base-libs1.4.3.39-28.module_el8.10.0+4274+00f9a3f1
alma 8389-ds:1.4::389-ds-base-snmp1.4.3.39-28.module_el8.10.0+4274+00f9a3f1
alma 8389-ds:1.4::python3-lib3891.4.3.39-28.module_el8.10.0+4274+00f9a3f1
alma 9389-ds-base2.8.0-10.el9_8
alma 9389-ds-base-devel2.8.0-10.el9_8
alma 9389-ds-base-libs2.8.0-10.el9_8
alma 9389-ds-base-snmp2.8.0-10.el9_8
alma 9python3-lib3892.8.0-10.el9_8
amazon linux 2389-ds-base1.3.10.2-17.amzn2.0.9
amazon linux 2389-ds-base-debuginfo1.3.10.2-17.amzn2.0.9
amazon linux 2389-ds-base-devel1.3.10.2-17.amzn2.0.9
amazon linux 2389-ds-base-libs1.3.10.2-17.amzn2.0.9
amazon linux 2389-ds-base-snmp1.3.10.2-17.amzn2.0.9
Oracle Linux 7389-ds-base1.3.11.1-5.0.15.el7_9
Oracle Linux 7389-ds-base-devel1.3.11.1-5.0.15.el7_9
Oracle Linux 7389-ds-base-libs1.3.11.1-5.0.15.el7_9
Oracle Linux 7389-ds-base-snmp1.3.11.1-5.0.15.el7_9
Oracle Linux 8389-ds-base1.4.3.39-28.module+el8.10.0+91024+7bf29691
Oracle Linux 8389-ds-base-devel1.4.3.39-28.module+el8.10.0+91024+7bf29691
Oracle Linux 8389-ds-base-legacy-tools1.4.3.39-28.module+el8.10.0+91024+7bf29691
Oracle Linux 8389-ds-base-libs1.4.3.39-28.module+el8.10.0+91024+7bf29691
Oracle Linux 8389-ds-base-snmp1.4.3.39-28.module+el8.10.0+91024+7bf29691
Oracle Linux 8python3-lib3891.4.3.39-28.module+el8.10.0+91024+7bf29691
Oracle Linux 9389-ds-base2.8.0-10.el9_8
Oracle Linux 9389-ds-base-devel2.8.0-10.el9_8
Oracle Linux 9389-ds-base-libs2.8.0-10.el9_8
Oracle Linux 9389-ds-base-snmp2.8.0-10.el9_8
Oracle Linux 9python3-lib3892.8.0-10.el9_8
rocky 10389-ds-base3.2.0-10.el10_2
rocky 10389-ds-base-libs3.2.0-10.el10_2
rocky 10389-ds-base-snmp3.2.0-10.el10_2
rocky 10python3-lib3893.2.0-10.el10_2
rocky 8389-ds:1.4::389-ds-base1.4.3.39-28.module+el8.10.0+40311+cd962df1
rocky 8389-ds:1.4::389-ds-base-devel1.4.3.39-28.module+el8.10.0+40311+cd962df1
rocky 8389-ds:1.4::389-ds-base-legacy-tools1.4.3.39-28.module+el8.10.0+40311+cd962df1
rocky 8389-ds:1.4::389-ds-base-libs1.4.3.39-28.module+el8.10.0+40311+cd962df1
rocky 8389-ds:1.4::389-ds-base-snmp1.4.3.39-28.module+el8.10.0+40311+cd962df1
rocky 8389-ds:1.4::python3-lib3891.4.3.39-28.module+el8.10.0+40311+cd962df1
rocky 9389-ds-base2.8.0-10.el9_8
rocky 9389-ds-base-libs2.8.0-10.el9_8
rocky 9389-ds-base-snmp2.8.0-10.el9_8
rocky 9python3-lib3892.8.0-10.el9_8
debian 11389-ds-basesin corrección indicada
debian 12389-ds-basesin corrección indicada
debian 13389-ds-basesin corrección indicada
echo389-ds-basesin corrección indicada
rapidfort alma 10389-ds-base3.2.0-10.el10_2
rapidfort alma 10389-ds-base-bdb3.2.0-10.el10_2
rapidfort alma 10389-ds-base-devel3.2.0-10.el10_2
rapidfort alma 10389-ds-base-libs3.2.0-10.el10_2
rapidfort alma 10389-ds-base-snmp3.2.0-10.el10_2
rapidfort alma 10python3-lib3893.2.0-10.el10_2
rapidfort alma 9389-ds-base2.8.0-10.el9_8
rapidfort alma 9389-ds-base-libs2.8.0-10.el9_8
rapidfort alma 9389-ds-base-snmp2.8.0-10.el9_8
rapidfort alma 9python3-lib3892.8.0-10.el9_8
rapidfort debian 12389-ds-basesin corrección indicada
rapidfort debian 13389-ds-basesin corrección indicada
rapidfort Oracle Linux 10389-ds-base0:3.2.0-10.el10_2
rapidfort Oracle Linux 10389-ds-base-libs0:3.2.0-10.el10_2
rapidfort Oracle Linux 10389-ds-base-snmp0:3.2.0-10.el10_2
rapidfort Oracle Linux 10python3-lib3890:3.2.0-10.el10_2
rapidfort Oracle Linux 9389-ds-base0:2.8.0-10.el9_8
rapidfort Oracle Linux 9389-ds-base-libs0:2.8.0-10.el9_8
rapidfort Oracle Linux 9389-ds-base-snmp0:2.8.0-10.el9_8
rapidfort Oracle Linux 9python3-lib3890:2.8.0-10.el9_8
rapidfort rocky 9389-ds-base0:2.8.0-10.el9_8
rapidfort rocky 9389-ds-base-libs0:2.8.0-10.el9_8
rapidfort rocky 9389-ds-base-snmp0:2.8.0-10.el9_8

Referencias

Las 40 referencias

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.