Redhat Directory Server vulnerabilities

CVE-2010-2222 [HIGH] CWE-476 CVE-2010-2222: The _ger_parse_control function in Red Hat Directory Server 8 and the 389 Directory Server allows at The _ger_parse_control function in Red Hat Directory Server 8 and the 389 Directory Server allows attackers to cause a denial of service (NULL pointer dereference) via a crafted search query.

CVE-2026-14940 [MEDIUM] CWE-122 CVE-2026-14940: A heap-buffer-overflow flaw was found in 389 Directory Server (389-ds-base). When normalizing a Dist A heap-buffer-overflow flaw was found in 389 Directory Server (389-ds-base). When normalizing a Distinguished Name (DN) that contains a legacy-quoted value encoding a multivalued nested Relative Distinguished Name (RDN), the server can write past the end of a heap allocation while sorting RDN attribute-value pairs. An unauthenticated remote attacker

CVE-2011-0019 [HIGH] CWE-20 CVE-2011-0019: slapd (aka ns-slapd) in 389 Directory Server 1.2.7.5 (aka Red Hat Directory Server 8.2.x or dirsrv) slapd (aka ns-slapd) in 389 Directory Server 1.2.7.5 (aka Red Hat Directory Server 8.2.x or dirsrv) does not properly handle simple paged result searches, which allows remote attackers to cause a denial of service (daemon crash) or possibly have unspecified other impact via multiple search requests.

CVE-2026-11791 [MEDIUM] CWE-416 CVE-2026-11791: A flaw was found in 389 Directory Server. During schema reload, the attr_syntax_swap_ht() function u A flaw was found in 389 Directory Server. During schema reload, the attr_syntax_swap_ht() function unconditionally frees attribute syntax information nodes, bypassing the refcount-based deferred deletion used elsewhere in the attribute syntax subsystem. If an administrator triggers schema reload while concurrent LDAP query traffic is active, worker

CVE-2026-11790 [MEDIUM] CWE-400 CVE-2026-11790: A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password storage plugin does not enforce A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password storage plugin does not enforce an upper bound on the iteration count extracted from stored password hashes. A privileged attacker who can modify a user's password hash can cause excessive CPU consumption during authentication, resulting in denial of service.

CVE-2014-3562 [MEDIUM] CWE-200 CVE-2014-3562: Red Hat Directory Server 8 and 389 Directory Server, when debugging is enabled, allows remote attack Red Hat Directory Server 8 and 389 Directory Server, when debugging is enabled, allows remote attackers to obtain sensitive replicated metadata by searching the directory.

CVE-2023-1055 [MEDIUM] CWE-200 CVE-2023-1055: A flaw was found in RHDS 11 and RHDS 12. While browsing entries LDAP tries to decode the userPasswor A flaw was found in RHDS 11 and RHDS 12. While browsing entries LDAP tries to decode the userPassword attribute instead of the userCertificate attribute which could lead into sensitive information leaked. An attacker with a local account where the cockpit-389-ds is running can list the processes and display the hashed passwords. The highest threat fro

CVE-2024-1062 [MEDIUM] CWE-122 CVE-2024-1062: A heap overflow flaw was found in 389-ds-base. This issue leads to a denial of service when writing A heap overflow flaw was found in 389-ds-base. This issue leads to a denial of service when writing a value larger than 256 chars in log_entry_attr.

CVE-2026-11785 [MEDIUM] CWE-843 CVE-2026-11785: A flaw was found in 389 Directory Server. A type confusion in the SSO token extended operation handl A flaw was found in 389 Directory Server. A type confusion in the SSO token extended operation handler causes partial stack address information to be disclosed in LDAP responses to authenticated users.

CVE-2011-0532 [MEDIUM] CWE-264 CVE-2011-0532: The (1) backup and restore scripts, (2) main initialization script, and (3) ldap-agent script in 389 The (1) backup and restore scripts, (2) main initialization script, and (3) ldap-agent script in 389 Directory Server 1.2.x (aka Red Hat Directory Server 8.2.x) place a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.

CVE-2026-14969 [MEDIUM] CWE-329 CVE-2026-14969: A flaw was found in 389-ds-base where the LDBM backend attribute encryption uses a hardcoded static A flaw was found in 389-ds-base where the LDBM backend attribute encryption uses a hardcoded static initialization vector for AES-CBC and 3DES-CBC operations, allowing an attacker with privileged filesystem access to detect plaintext equality across encrypted entries by comparing ciphertext blocks.

CVE-2008-2929 [MEDIUM] CWE-79 CVE-2008-2929: Multiple cross-site scripting (XSS) vulnerabilities in the adminutil library in the Directory Server Multiple cross-site scripting (XSS) vulnerabilities in the adminutil library in the Directory Server Administration Express and Directory Server Gateway (DSGW) web interface in Red Hat Directory Server 7.1 before SP7 and 8 EL4 and EL5, and Fedora Directory Server, allow remote attackers to inject arbitrary web script or HTML via input values that use %

CVE-2013-2219 [MEDIUM] CWE-264 CVE-2013-2219: The Red Hat Directory Server before 8.2.11-13 and 389 Directory Server do not properly restrict acce The Red Hat Directory Server before 8.2.11-13 and 389 Directory Server do not properly restrict access to entity attributes, which allows remote authenticated users to obtain sensitive information via a search query for the attribute.

CVE-2011-0022 [MEDIUM] CWE-399 CVE-2011-0022: The setup scripts in 389 Directory Server 1.2.x (aka Red Hat Directory Server 8.2.x), when multiple The setup scripts in 389 Directory Server 1.2.x (aka Red Hat Directory Server 8.2.x), when multiple unprivileged instances are configured, use 0777 permissions for the /var/run/dirsrv directory, which allows local users to cause a denial of service (daemon outage or arbitrary process termination) by replacing PID files contained in this directory.

CVE-2012-2678 [LOW] CWE-310 CVE-2012-2678: 389 Directory Server before 1.2.11.6 (aka Red Hat Directory Server before 8.2.10-3), after the passw 389 Directory Server before 1.2.11.6 (aka Red Hat Directory Server before 8.2.10-3), after the password for a LDAP user has been changed and before the server has been reset, allows remote attackers to read the plaintext password via the unhashed#user#password attribute.

CVE-2026-15041 [LOW] CWE-208 CVE-2026-15041: A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password verification function uses stan A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password verification function uses standard memcmp() for comparing password hashes instead of a constant-time comparison function. A remote attacker could potentially use timing measurements of LDAP bind attempts to infer partial hash information, though practical exploitation is extremely di

CVE-2013-4485 [MEDIUM] CWE-20 CVE-2013-4485: 389 Directory Server 1.2.11.15 (aka Red Hat Directory Server before 8.2.11-14) allows remote authent 389 Directory Server 1.2.11.15 (aka Red Hat Directory Server before 8.2.11-14) allows remote authenticated users to cause a denial of service (crash) via multiple @ characters in a GER attribute list in a search request.

CVE-2008-0890 [MEDIUM] CWE-264 CVE-2008-0890: Red Hat Directory Server 7.1 before SP4 uses insecure permissions for certain directories, which all Red Hat Directory Server 7.1 before SP4 uses insecure permissions for certain directories, which allows local users to modify JAR files and execute arbitrary code via unknown vectors.

CVE-2012-2746 [LOW] CWE-310 CVE-2012-2746: 389 Directory Server before 1.2.11.6 (aka Red Hat Directory Server before 8.2.10-3), when the passwo 389 Directory Server before 1.2.11.6 (aka Red Hat Directory Server before 8.2.10-3), when the password of a LDAP user has been changed and audit logging is enabled, saves the new password to the log in plain text, which allows remote authenticated users to read the password.

CVE-2010-3282 [LOW] CWE-312 CVE-2010-3282: 389 Directory Server before 1.2.7.1 (aka Red Hat Directory Server 8.2) and HP-UX Directory Server be 389 Directory Server before 1.2.7.1 (aka Red Hat Directory Server 8.2) and HP-UX Directory Server before B.08.10.03, when audit logging is enabled, logs the Directory Manager password (nsslapd-rootpw) in cleartext when changing cn=config:nsslapd-rootpw, which might allow local users to obtain sensitive information by reading the log.