CVE-2019-14824
Fixed in a distro release EPSS 1%CVSS 6.5
A flaw was found in the 'deref' plugin of 389-ds-base where it could use the 'search' permission to display attribute values. In some configurations, this could allow an authenticated attacker to view private attributes, such as password hashes.
Products: fedoraproject 389_directory_server, redhat enterprise_linux, debian_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2 | 389-ds-base | 1.3.9.1-12.amzn2.0.1 |
| Amazon Linux 2 | 389-ds-base-devel | 1.3.9.1-12.amzn2.0.1 |
| Amazon Linux 2 | 389-ds-base-libs | 1.3.9.1-12.amzn2.0.1 |
| Amazon Linux 2 | 389-ds-base-snmp | 1.3.9.1-12.amzn2.0.1 |
| Debian 10 | 389-ds-base | 1.4.0.21-1+deb10u1 |
| Debian 12 | 389-ds-base | 1.4.2.4-1 |
| Debian 13 | 389-ds-base | 1.4.2.4-1 |
| Debian 8 | 389-ds-base | 1.3.3.5-4+deb8u7 |
| Red Hat Enterprise Linux 7 | 389-ds-base | 0:1.3.9.1-12.el7_7 |
| Red Hat Enterprise Linux 7 | 389-ds-base-debuginfo | 0:1.3.9.1-12.el7_7 |
| Red Hat Enterprise Linux 7 | 389-ds-base-devel | 0:1.3.9.1-12.el7_7 |
| Red Hat Enterprise Linux 7 | 389-ds-base-libs | 0:1.3.9.1-12.el7_7 |
| Red Hat Enterprise Linux 7 | 389-ds-base-snmp | 0:1.3.9.1-12.el7_7 |
| Red Hat Enterprise Linux 8 | 389-ds-base | 0:1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f |
| Red Hat Enterprise Linux 8 | 389-ds-base-debuginfo | 0:1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f |
| Red Hat Enterprise Linux 8 | 389-ds-base-debugsource | 0:1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f |
| Red Hat Enterprise Linux 8 | 389-ds-base-devel | 0:1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f |
| Red Hat Enterprise Linux 8 | 389-ds-base-legacy-tools | 0:1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f |
| Red Hat Enterprise Linux 8 | 389-ds-base-legacy-tools-debuginfo | 0:1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f |
| Red Hat Enterprise Linux 8 | 389-ds-base-libs | 0:1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f |
| Red Hat Enterprise Linux 8 | 389-ds-base-libs-debuginfo | 0:1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f |
| Red Hat Enterprise Linux 8 | 389-ds-base-snmp | 0:1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f |
| Red Hat Enterprise Linux 8 | 389-ds-base-snmp-debuginfo | 0:1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f |
| Red Hat Enterprise Linux 8 | python3-lib389 | 0:1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f |
| Red Hat rhel e4s 8.0 | 389-ds-base | 0:1.4.0.20-10.1.module+el8.0.0+4597+364a3066 |
| Red Hat rhel e4s 8.0 | 389-ds-base-debuginfo | 0:1.4.0.20-10.1.module+el8.0.0+4597+364a3066 |
| Red Hat rhel e4s 8.0 | 389-ds-base-debugsource | 0:1.4.0.20-10.1.module+el8.0.0+4597+364a3066 |
| Red Hat rhel e4s 8.0 | 389-ds-base-devel | 0:1.4.0.20-10.1.module+el8.0.0+4597+364a3066 |
| Red Hat rhel e4s 8.0 | 389-ds-base-legacy-tools | 0:1.4.0.20-10.1.module+el8.0.0+4597+364a3066 |
| Red Hat rhel e4s 8.0 | 389-ds-base-legacy-tools-debuginfo | 0:1.4.0.20-10.1.module+el8.0.0+4597+364a3066 |
| Red Hat rhel e4s 8.0 | 389-ds-base-libs | 0:1.4.0.20-10.1.module+el8.0.0+4597+364a3066 |
| Red Hat rhel e4s 8.0 | 389-ds-base-libs-debuginfo | 0:1.4.0.20-10.1.module+el8.0.0+4597+364a3066 |
| Red Hat rhel e4s 8.0 | 389-ds-base-snmp | 0:1.4.0.20-10.1.module+el8.0.0+4597+364a3066 |
| Red Hat rhel e4s 8.0 | 389-ds-base-snmp-debuginfo | 0:1.4.0.20-10.1.module+el8.0.0+4597+364a3066 |
| Red Hat rhel e4s 8.0 | python3-lib389 | 0:1.4.0.20-10.1.module+el8.0.0+4597+364a3066 |
| Ubuntu 26.04 LTS | 389-ds-base | no fix |
| Ubuntu 26.10 | 389-ds-base | no fix |
| Ubuntu Pro 16.04 LTS | 389-ds-base | no fix |
| Ubuntu Pro 18.04 LTS | 389-ds-base | no fix |
| openSUSE Tumbleweed | 389-ds | 2.0.10~git0.21dd2802c-1.1 |