When binding against a DN during authentication, the reply from 389-ds-base will be different whether the DN exists or not. This can be used by an unauthenticated attacker to check the existence of an entry in the LDAP database.
Created 389-ds-base tracking bugs for this issue: Affects: fedora-all [bug 1908653]
Hi Cedric, is there by chance an upstrema reference for this? Was this already fixed? Regards, Salvatore
(In reply to Salvatore Bonaccorso from comment #12) > Hi Cedric, > > is there by chance an upstrema reference for this? Was this already fixed? > > Regards, > Salvatore This was fixed upstream via: https://github.com/389ds/389-ds-base/issues/4480
Hi (In reply to mreynolds from comment #13) > (In reply to Salvatore Bonaccorso from comment #12) > > Hi Cedric, > > > > is there by chance an upstrema reference for this? Was this already fixed? > > > > Regards, > > Salvatore > > This was fixed upstream via: > > https://github.com/389ds/389-ds-base/issues/4480 Thank you. Regards, Salvatore
I am not sure this fix is sufficient. Last time I checked, I could still deduce the existence of an object without authenticating.
(In reply to Cedric Buissart from comment #15) > I am not sure this fix is sufficient. > Last time I checked, I could still deduce the existence of an object without > authenticating. Hi Cedric, I think it is. I answered one of the concern https://bugzilla.redhat.com/show_bug.cgi?id=1904991#c12. Is it the concern your were thinking of when saying the fix is not sufficient ?
This issue has been addressed in the following products: Red Hat Directory Server 11.1 for RHEL 8 Via RHSA-2021:0599 https://access.redhat.com/errata/RHSA-2021:0599
List of upstream fixes : https://github.com/389ds/389-ds-base/commit/cc0f69283abc082488824702dae485b8eae938bc https://github.com/389ds/389-ds-base/commit/b6aae4d8e7c8a6ddd21646f94fef1bf7f22c3f32
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2021:1086 https://access.redhat.com/errata/RHSA-2021:1086
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-35518
This issue has been addressed in the following products: Red Hat Directory Server 11.2 for RHEL 8 Via RHSA-2021:1243 https://access.redhat.com/errata/RHSA-2021:1243
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.2 Extended Update Support Via RHSA-2021:1258 https://access.redhat.com/errata/RHSA-2021:1258
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2021:2323 https://access.redhat.com/errata/RHSA-2021:2323