Attestkeep
Langue : Français
S'inscrire

Vulnérabilités / CVE-2026-18922

critique

CVE-2026-18922

389-ds-base: 389-ds-base: SASL PLAIN authentication allows privilege escalation to Directory Manager via stale identity in Cyrus SASL auxiliary property

Publiée Modifiée CWE 287
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.

Sévérité par source

Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Le label propre à Trivy est CRITICAL. Critique selon Red Hat, AlmaLinux, Amazon, Oracle, Rocky Linux.

Description

A flaw was found in 389 Directory Server. During SASL PLAIN authentication, a stale identity carried in a Cyrus SASL auxiliary property from a prior failed bind attempt can be installed on a connection following a subsequent, unrelated successful bind, regardless of which SASL mechanism completes that second bind. An attacker can send a SASL PLAIN bind as cn=Directory Manager with an incorrect password, then complete a SASL ANONYMOUS bind on the same connection, causing the server to grant Directory Manager authority without any valid credentials. A variant using a valid low-privileged account's own successful bind instead of an anonymous one is also possible.

Paquets affectés et versions corrigées

SourcePaquetCorrigé en
alma 10389-ds-base, 389-ds-base-bdb, 389-ds-base-devel et 3 autres3.2.0-10.el10_2
alma 8389-ds:1.4::389-ds-base, 389-ds:1.4::389-ds-base-devel, 389-ds:1.4::389-ds-base-legacy-tools et 3 autres1.4.3.39-28.module_el8.10.0+4274+00f9a3f1
alma 9389-ds-base, 389-ds-base-devel, 389-ds-base-libs et 2 autres2.8.0-10.el9_8
amazon linux 2389-ds-base, 389-ds-base-debuginfo, 389-ds-base-devel et 2 autres1.3.10.2-17.amzn2.0.9
Oracle Linux 7389-ds-base, 389-ds-base-devel, 389-ds-base-libs et 1 autres1.3.11.1-5.0.15.el7_9
Oracle Linux 8389-ds-base, 389-ds-base-devel, 389-ds-base-legacy-tools et 3 autres1.4.3.39-28.module+el8.10.0+91024+7bf29691
Oracle Linux 9389-ds-base, 389-ds-base-devel, 389-ds-base-libs et 2 autres2.8.0-10.el9_8
rocky 10389-ds-base, 389-ds-base-libs, 389-ds-base-snmp et 1 autres3.2.0-10.el10_2
rocky 8389-ds:1.4::389-ds-base, 389-ds:1.4::389-ds-base-devel, 389-ds:1.4::389-ds-base-legacy-tools et 3 autres1.4.3.39-28.module+el8.10.0+40311+cd962df1
rocky 9389-ds-base, 389-ds-base-libs, 389-ds-base-snmp et 1 autres2.8.0-10.el9_8
debian 11389-ds-basepas de correctif indiqué
debian 12389-ds-basepas de correctif indiqué
Afficher les 78 entrées de 21 sources
SourcePaquetCorrigé en
alma 10389-ds-base3.2.0-10.el10_2
alma 10389-ds-base-bdb3.2.0-10.el10_2
alma 10389-ds-base-devel3.2.0-10.el10_2
alma 10389-ds-base-libs3.2.0-10.el10_2
alma 10389-ds-base-snmp3.2.0-10.el10_2
alma 10python3-lib3893.2.0-10.el10_2
alma 8389-ds:1.4::389-ds-base1.4.3.39-28.module_el8.10.0+4274+00f9a3f1
alma 8389-ds:1.4::389-ds-base-devel1.4.3.39-28.module_el8.10.0+4274+00f9a3f1
alma 8389-ds:1.4::389-ds-base-legacy-tools1.4.3.39-28.module_el8.10.0+4274+00f9a3f1
alma 8389-ds:1.4::389-ds-base-libs1.4.3.39-28.module_el8.10.0+4274+00f9a3f1
alma 8389-ds:1.4::389-ds-base-snmp1.4.3.39-28.module_el8.10.0+4274+00f9a3f1
alma 8389-ds:1.4::python3-lib3891.4.3.39-28.module_el8.10.0+4274+00f9a3f1
alma 9389-ds-base2.8.0-10.el9_8
alma 9389-ds-base-devel2.8.0-10.el9_8
alma 9389-ds-base-libs2.8.0-10.el9_8
alma 9389-ds-base-snmp2.8.0-10.el9_8
alma 9python3-lib3892.8.0-10.el9_8
amazon linux 2389-ds-base1.3.10.2-17.amzn2.0.9
amazon linux 2389-ds-base-debuginfo1.3.10.2-17.amzn2.0.9
amazon linux 2389-ds-base-devel1.3.10.2-17.amzn2.0.9
amazon linux 2389-ds-base-libs1.3.10.2-17.amzn2.0.9
amazon linux 2389-ds-base-snmp1.3.10.2-17.amzn2.0.9
Oracle Linux 7389-ds-base1.3.11.1-5.0.15.el7_9
Oracle Linux 7389-ds-base-devel1.3.11.1-5.0.15.el7_9
Oracle Linux 7389-ds-base-libs1.3.11.1-5.0.15.el7_9
Oracle Linux 7389-ds-base-snmp1.3.11.1-5.0.15.el7_9
Oracle Linux 8389-ds-base1.4.3.39-28.module+el8.10.0+91024+7bf29691
Oracle Linux 8389-ds-base-devel1.4.3.39-28.module+el8.10.0+91024+7bf29691
Oracle Linux 8389-ds-base-legacy-tools1.4.3.39-28.module+el8.10.0+91024+7bf29691
Oracle Linux 8389-ds-base-libs1.4.3.39-28.module+el8.10.0+91024+7bf29691
Oracle Linux 8389-ds-base-snmp1.4.3.39-28.module+el8.10.0+91024+7bf29691
Oracle Linux 8python3-lib3891.4.3.39-28.module+el8.10.0+91024+7bf29691
Oracle Linux 9389-ds-base2.8.0-10.el9_8
Oracle Linux 9389-ds-base-devel2.8.0-10.el9_8
Oracle Linux 9389-ds-base-libs2.8.0-10.el9_8
Oracle Linux 9389-ds-base-snmp2.8.0-10.el9_8
Oracle Linux 9python3-lib3892.8.0-10.el9_8
rocky 10389-ds-base3.2.0-10.el10_2
rocky 10389-ds-base-libs3.2.0-10.el10_2
rocky 10389-ds-base-snmp3.2.0-10.el10_2
rocky 10python3-lib3893.2.0-10.el10_2
rocky 8389-ds:1.4::389-ds-base1.4.3.39-28.module+el8.10.0+40311+cd962df1
rocky 8389-ds:1.4::389-ds-base-devel1.4.3.39-28.module+el8.10.0+40311+cd962df1
rocky 8389-ds:1.4::389-ds-base-legacy-tools1.4.3.39-28.module+el8.10.0+40311+cd962df1
rocky 8389-ds:1.4::389-ds-base-libs1.4.3.39-28.module+el8.10.0+40311+cd962df1
rocky 8389-ds:1.4::389-ds-base-snmp1.4.3.39-28.module+el8.10.0+40311+cd962df1
rocky 8389-ds:1.4::python3-lib3891.4.3.39-28.module+el8.10.0+40311+cd962df1
rocky 9389-ds-base2.8.0-10.el9_8
rocky 9389-ds-base-libs2.8.0-10.el9_8
rocky 9389-ds-base-snmp2.8.0-10.el9_8
rocky 9python3-lib3892.8.0-10.el9_8
debian 11389-ds-basepas de correctif indiqué
debian 12389-ds-basepas de correctif indiqué
debian 13389-ds-basepas de correctif indiqué
echo389-ds-basepas de correctif indiqué
rapidfort alma 10389-ds-base3.2.0-10.el10_2
rapidfort alma 10389-ds-base-bdb3.2.0-10.el10_2
rapidfort alma 10389-ds-base-devel3.2.0-10.el10_2
rapidfort alma 10389-ds-base-libs3.2.0-10.el10_2
rapidfort alma 10389-ds-base-snmp3.2.0-10.el10_2
rapidfort alma 10python3-lib3893.2.0-10.el10_2
rapidfort alma 9389-ds-base2.8.0-10.el9_8
rapidfort alma 9389-ds-base-libs2.8.0-10.el9_8
rapidfort alma 9389-ds-base-snmp2.8.0-10.el9_8
rapidfort alma 9python3-lib3892.8.0-10.el9_8
rapidfort debian 12389-ds-basepas de correctif indiqué
rapidfort debian 13389-ds-basepas de correctif indiqué
rapidfort Oracle Linux 10389-ds-base0:3.2.0-10.el10_2
rapidfort Oracle Linux 10389-ds-base-libs0:3.2.0-10.el10_2
rapidfort Oracle Linux 10389-ds-base-snmp0:3.2.0-10.el10_2
rapidfort Oracle Linux 10python3-lib3890:3.2.0-10.el10_2
rapidfort Oracle Linux 9389-ds-base0:2.8.0-10.el9_8
rapidfort Oracle Linux 9389-ds-base-libs0:2.8.0-10.el9_8
rapidfort Oracle Linux 9389-ds-base-snmp0:2.8.0-10.el9_8
rapidfort Oracle Linux 9python3-lib3890:2.8.0-10.el9_8
rapidfort rocky 9389-ds-base0:2.8.0-10.el9_8
rapidfort rocky 9389-ds-base-libs0:2.8.0-10.el9_8
rapidfort rocky 9389-ds-base-snmp0:2.8.0-10.el9_8

Références

Les 40 références

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.