CVE-2020-35518

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-03-26 · updated 2026-06-17
Weakness: CWE-200

Description

When binding against a DN during authentication, the reply from 389-ds-base will be different whether the DN exists or not. This can be used by an unauthenticated attacker to check the existence of an entry in the LDAP database.

Affected products

Red Hat 389 Directory Server: before 1.4.3.19; from 1.4.4.0 before 1.4.4.13; from 2.0.0 before 2.0.3 — fixed in 1.4.3.19, 1.4.4.13, 2.0.3
RedHat Directory Server: 11.0
Red Hat Enterprise Linux: 7.0, 8.0

How to fix

Upgrade to a fixed version: Red Hat 389 Directory Server 1.4.3.19, 1.4.4.13, 2.0.3. Check the vendor advisory for mitigations.

References

https://bugzilla.redhat.com/show_bug.cgi?id=1905565
https://github.com/389ds/389-ds-base/commit/b6aae4d8e7c8a6ddd21646f94fef1bf7f22c3f32
https://github.com/389ds/389-ds-base/commit/cc0f69283abc082488824702dae485b8eae938bc
https://github.com/389ds/389-ds-base/issues/4480
https://bugzilla.redhat.com/show_bug.cgi?id=1905565
https://github.com/389ds/389-ds-base/commit/b6aae4d8e7c8a6ddd21646f94fef1bf7f22c3f32
https://github.com/389ds/389-ds-base/commit/cc0f69283abc082488824702dae485b8eae938bc
https://github.com/389ds/389-ds-base/issues/4480

Get alerted when CVE-2020-35518 or the next vulnerability affects your stack