Fedora Account System
Red Hat Associate
Red Hat Customer
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password verification function pbkdf2_sha256_pw_cmp() in ldap/servers/plugins/pwdstorage/pbkdf2_pwd.c uses standard memcmp() for hash comparison instead of the project's constant-time slapi_ct_memcmp(). Every other password storage scheme in the same plugin uses slapi_ct_memcmp(), which was introduced specifically to prevent timing side-channels (see CVE-2016-5405). This inconsistency allows a remote attacker with network access to the LDAP service to potentially infer partial hash information through repeated timing measurements of LDAP bind attempts. Practical exploitation is extremely difficult due to the PBKDF2 work factor (8192+ iterations, ~2ms computation time) which dominates and masks the nanosecond-level memcmp timing delta.
This bug appears to have been reported against 'rawhide' during the Fedora Linux 45 development cycle. Changing version to 45.
Fixed in https://github.com/389ds/389-ds-base/commit/293b88c91
FEDORA-2026-b16c9cbc0f (389-ds-base-3.2.3-2.fc44) has been submitted as an update to Fedora 44. https://bodhi.fedoraproject.org/updates/FEDORA-2026-b16c9cbc0f
FEDORA-2026-c1e25a4642 has been pushed to the Fedora 45 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-c1e25a4642` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-c1e25a4642 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2026-b16c9cbc0f has been pushed to the Fedora 44 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-b16c9cbc0f` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-b16c9cbc0f See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2026-0b8bc362b1 has been pushed to the Fedora 43 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-0b8bc362b1` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-0b8bc362b1 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.