Every CVE Search/ Get API key

CVE-2020-35518

When binding against a DN during authentication, the reply from 389-ds-base will be different...

5.3 MediumFix available

When binding against a DN during authentication, the reply from 389-ds-base will be different whether the DN exists or not. This can be used by an unauthenticated attacker to check the existence of an entry in the LDAP database.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
None

Exploit likelihood

1.54%Up 0.5 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 5.3

When binding against a DN during authentication, the reply from 389-ds-base will be different whether the DN exists or not. This can be used by an unauthenticated attacker to check the existence of an entry in the LDAP database.

Record
CVE-2020-35518
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness
CWE-200, CWE-203
Updated
2026-11-02
CVE List No score

When binding against a DN during authentication, the reply from 389-ds-base will be different whether the DN exists or not. This can be used by an unauthenticated attacker to check the existence of an entry in the LDAP database.

Record
CVE-2020-35518
Weakness
CWE-200
Updated
2026-11-02
EUVDEUVD-2020-23185 No score

When binding against a DN during authentication, the reply from 389-ds-base will be different whether the DN exists or not. This can be used by an unauthenticated attacker to check the existence of an entry in the LDAP database.

Record
EUVD-2020-23185
Updated
2026-11-03
GitHub AdvisoriesGHSA-vg4h-9m5m-rchq 5.3

When binding against a DN during authentication, the reply from 389-ds-base will be different...

When binding against a DN during authentication, the reply from 389-ds-base will be different whether the DN exists or not. This can be used by an unauthenticated attacker to check the existence of an entry in the LDAP database.

Record
GHSA-vg4h-9m5m-rchq
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-200, CWE-203
Updated
2026-11-02
OSV 5.3

When binding against a DN during authentication, the reply from 389-ds-base will be different whether the DN exists or not. This can be used by an unauthenticated attacker to check the existence of an entry in the LDAP database.

Record
CVE-2020-35518
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2020-35518 5.3

When binding against a DN during authentication, the reply from 389-ds-base will be different whether the DN exists or not. This can be used by an unauthenticated attacker to check the existence of an entry in the LDAP database.

Record
DEBIAN-CVE-2020-35518
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
Show 11 moreShow less
OSVOESA-2022-1602 5.3

three-eight-nine-ds-base security update

389-ds-base is an LDAPv3 compliant server which includes the LDAP server and command line utilities for server administration.

Security Fix(es):

When binding against a DN during authentication, the reply from 389-ds-base will be different whether the DN exists or not. This can be used by an unauthenticated attacker to check the existence of an entry in the LDAP database.(CVE-2020-35518)

Record
OESA-2022-1602
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVOESA-2022-2056 5.3

three-eight-nine-ds-base security update

389-ds-base is an LDAPv3 compliant server which includes the LDAP server and command line utilities for server administration.

Security Fix(es):

When binding against a DN during authentication, the reply from 389-ds-base will be different whether the DN exists or not. This can be used by an unauthenticated attacker to check the existence of an entry in the LDAP database.(CVE-2020-35518)

Record
OESA-2022-2056
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVRHSA-2021:0599 5.3

Red Hat Security Advisory: redhat-ds:11 security and bug fix update

Record
RHSA-2021:0599
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVRHSA-2021:1086 5.3

Red Hat Security Advisory: 389-ds:1.4 security and bug fix update

Record
RHSA-2021:1086
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVRHSA-2021:1243 5.3

Red Hat Security Advisory: redhat-ds:11 security and bug fix update

Record
RHSA-2021:1243
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVRHSA-2021:1258 5.3

Red Hat Security Advisory: 389-ds:1.4 security and bug fix update

Record
RHSA-2021:1258
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVRHSA-2021:2323 5.3

Red Hat Security Advisory: 389-ds-base security and bug fix update

Record
RHSA-2021:2323
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2020-35518 5.3

When binding against a DN during authentication, the reply from 389-ds-base will be different whether the DN exists or not. This can be used by an unauthenticated attacker to check the existence of an entry in the LDAP database.

Record
UBUNTU-CVE-2020-35518
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVopenSUSE-SU-2021:0418-1 No score

Security update for 389-ds

This update for 389-ds fixes the following issues:

  • 389-ds was updated to version 1.4.3.19
    • CVE-2020-35518: Fixed an information disclosure during the binding of a DN (bsc#1181159).

This update was imported from the SUSE:SLE-15-SP2:Update update project.

Record
openSUSE-SU-2021:0418-1
Updated
2026-11-02
OSVSUSE-SU-2021:0724-1 No score

Security update for 389-ds

This update for 389-ds fixes the following issues:

  • 389-ds was updated to version 1.4.3.19
    • CVE-2020-35518: Fixed an information disclosure during the binding of a DN (bsc#1181159).
Record
SUSE-SU-2021:0724-1
Updated
2026-11-02
OSVUSN-5231-1 No score

389-ds-base vulnerabilities

It was discovered that 389 Directory Server presented to users, during authentication, an error message which could be used to discover if a certain LDAP DN existed or not. A remote unauthenticated attacker could possibly use this to check the existence of an entry in a LDAP database and expose sensitive information. This issue affected only Ubuntu 20.04 ESM. (CVE-2020-35518)

It was discovered that 389 Directory Server was incorrectly validating data used to access memory addresses. An authenticated attacker using a Syncrepl client could use this issue with a specially crafted query to cause 389 Directory Server to crash, resulting in a denial of service. (CVE-2021-3514)

Record
USN-5231-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
389-ds-base
Debian:12
before 1.4.4.10-1
1.4.4.10-1
389-ds-base
Debian:13
before 1.4.4.10-1
1.4.4.10-1
three-eight-nine-ds-base
openEuler:20.03-LTS-SP1
before 389-ds-base-1.4.3.20-1.oe1
389-ds-base-1.4.3.20-1.oe1
three-eight-nine-ds-base
openEuler:20.03-LTS-SP2
before 389-ds-base-1.4.3.20-1.oe1
389-ds-base-1.4.3.20-1.oe1
three-eight-nine-ds-base
openEuler:20.03-LTS-SP3
before 389-ds-base-1.4.3.20-1.oe1
389-ds-base-1.4.3.20-1.oe1
three-eight-nine-ds-base
openEuler:22.03-LTS
before 389-ds-base-1.4.3.20-1.oe2203
389-ds-base-1.4.3.20-1.oe2203
389-ds-base
Red Hat:directory_server:11.1::el8
before 0:1.4.2.12-5.module+el8dsrv+9896+eb95346c
0:1.4.2.12-5.module+el8dsrv+9896+eb95346c
389-ds-base-debuginfo
Red Hat:directory_server:11.1::el8
before 0:1.4.2.12-5.module+el8dsrv+9896+eb95346c
0:1.4.2.12-5.module+el8dsrv+9896+eb95346c
389-ds-base-debugsource
Red Hat:directory_server:11.1::el8
before 0:1.4.2.12-5.module+el8dsrv+9896+eb95346c
0:1.4.2.12-5.module+el8dsrv+9896+eb95346c
389-ds-base-devel
Red Hat:directory_server:11.1::el8
before 0:1.4.2.12-5.module+el8dsrv+9896+eb95346c
0:1.4.2.12-5.module+el8dsrv+9896+eb95346c
Show 68 moreShow less
Affected packages
PackageAffectedFixed
389-ds-base-legacy-tools
Red Hat:directory_server:11.1::el8
before 0:1.4.2.12-5.module+el8dsrv+9896+eb95346c
0:1.4.2.12-5.module+el8dsrv+9896+eb95346c
389-ds-base-legacy-tools-debuginfo
Red Hat:directory_server:11.1::el8
before 0:1.4.2.12-5.module+el8dsrv+9896+eb95346c
0:1.4.2.12-5.module+el8dsrv+9896+eb95346c
389-ds-base-libs
Red Hat:directory_server:11.1::el8
before 0:1.4.2.12-5.module+el8dsrv+9896+eb95346c
0:1.4.2.12-5.module+el8dsrv+9896+eb95346c
389-ds-base-libs-debuginfo
Red Hat:directory_server:11.1::el8
before 0:1.4.2.12-5.module+el8dsrv+9896+eb95346c
0:1.4.2.12-5.module+el8dsrv+9896+eb95346c
389-ds-base-snmp
Red Hat:directory_server:11.1::el8
before 0:1.4.2.12-5.module+el8dsrv+9896+eb95346c
0:1.4.2.12-5.module+el8dsrv+9896+eb95346c
389-ds-base-snmp-debuginfo
Red Hat:directory_server:11.1::el8
before 0:1.4.2.12-5.module+el8dsrv+9896+eb95346c
0:1.4.2.12-5.module+el8dsrv+9896+eb95346c
cockpit-389-ds
Red Hat:directory_server:11.1::el8
before 0:1.4.2.12-5.module+el8dsrv+9896+eb95346c
0:1.4.2.12-5.module+el8dsrv+9896+eb95346c
python3-lib389
Red Hat:directory_server:11.1::el8
before 0:1.4.2.12-5.module+el8dsrv+9896+eb95346c
0:1.4.2.12-5.module+el8dsrv+9896+eb95346c
389-ds-base
Red Hat:enterprise_linux:8::appstream
before 0:1.4.3.8-7.module+el8.3.0+10310+6e88d919
0:1.4.3.8-7.module+el8.3.0+10310+6e88d919
389-ds-base-debuginfo
Red Hat:enterprise_linux:8::appstream
before 0:1.4.3.8-7.module+el8.3.0+10310+6e88d919
0:1.4.3.8-7.module+el8.3.0+10310+6e88d919
389-ds-base-debugsource
Red Hat:enterprise_linux:8::appstream
before 0:1.4.3.8-7.module+el8.3.0+10310+6e88d919
0:1.4.3.8-7.module+el8.3.0+10310+6e88d919
389-ds-base-devel
Red Hat:enterprise_linux:8::appstream
before 0:1.4.3.8-7.module+el8.3.0+10310+6e88d919
0:1.4.3.8-7.module+el8.3.0+10310+6e88d919
389-ds-base-legacy-tools
Red Hat:enterprise_linux:8::appstream
before 0:1.4.3.8-7.module+el8.3.0+10310+6e88d919
0:1.4.3.8-7.module+el8.3.0+10310+6e88d919
389-ds-base-legacy-tools-debuginfo
Red Hat:enterprise_linux:8::appstream
before 0:1.4.3.8-7.module+el8.3.0+10310+6e88d919
0:1.4.3.8-7.module+el8.3.0+10310+6e88d919
389-ds-base-libs
Red Hat:enterprise_linux:8::appstream
before 0:1.4.3.8-7.module+el8.3.0+10310+6e88d919
0:1.4.3.8-7.module+el8.3.0+10310+6e88d919
389-ds-base-libs-debuginfo
Red Hat:enterprise_linux:8::appstream
before 0:1.4.3.8-7.module+el8.3.0+10310+6e88d919
0:1.4.3.8-7.module+el8.3.0+10310+6e88d919
389-ds-base-snmp
Red Hat:enterprise_linux:8::appstream
before 0:1.4.3.8-7.module+el8.3.0+10310+6e88d919
0:1.4.3.8-7.module+el8.3.0+10310+6e88d919
389-ds-base-snmp-debuginfo
Red Hat:enterprise_linux:8::appstream
before 0:1.4.3.8-7.module+el8.3.0+10310+6e88d919
0:1.4.3.8-7.module+el8.3.0+10310+6e88d919
python3-lib389
Red Hat:enterprise_linux:8::appstream
before 0:1.4.3.8-7.module+el8.3.0+10310+6e88d919
0:1.4.3.8-7.module+el8.3.0+10310+6e88d919
389-ds-base
Red Hat:directory_server:11.2::el8
before 0:1.4.3.21-3.module+el8dsrv+10401+3d549418
0:1.4.3.21-3.module+el8dsrv+10401+3d549418
389-ds-base-debuginfo
Red Hat:directory_server:11.2::el8
before 0:1.4.3.21-3.module+el8dsrv+10401+3d549418
0:1.4.3.21-3.module+el8dsrv+10401+3d549418
389-ds-base-debugsource
Red Hat:directory_server:11.2::el8
before 0:1.4.3.21-3.module+el8dsrv+10401+3d549418
0:1.4.3.21-3.module+el8dsrv+10401+3d549418
389-ds-base-devel
Red Hat:directory_server:11.2::el8
before 0:1.4.3.21-3.module+el8dsrv+10401+3d549418
0:1.4.3.21-3.module+el8dsrv+10401+3d549418
389-ds-base-legacy-tools
Red Hat:directory_server:11.2::el8
before 0:1.4.3.21-3.module+el8dsrv+10401+3d549418
0:1.4.3.21-3.module+el8dsrv+10401+3d549418
389-ds-base-legacy-tools-debuginfo
Red Hat:directory_server:11.2::el8
before 0:1.4.3.21-3.module+el8dsrv+10401+3d549418
0:1.4.3.21-3.module+el8dsrv+10401+3d549418
389-ds-base-libs
Red Hat:directory_server:11.2::el8
before 0:1.4.3.21-3.module+el8dsrv+10401+3d549418
0:1.4.3.21-3.module+el8dsrv+10401+3d549418
389-ds-base-libs-debuginfo
Red Hat:directory_server:11.2::el8
before 0:1.4.3.21-3.module+el8dsrv+10401+3d549418
0:1.4.3.21-3.module+el8dsrv+10401+3d549418
389-ds-base-snmp
Red Hat:directory_server:11.2::el8
before 0:1.4.3.21-3.module+el8dsrv+10401+3d549418
0:1.4.3.21-3.module+el8dsrv+10401+3d549418
389-ds-base-snmp-debuginfo
Red Hat:directory_server:11.2::el8
before 0:1.4.3.21-3.module+el8dsrv+10401+3d549418
0:1.4.3.21-3.module+el8dsrv+10401+3d549418
cockpit-389-ds
Red Hat:directory_server:11.2::el8
before 0:1.4.3.21-3.module+el8dsrv+10401+3d549418
0:1.4.3.21-3.module+el8dsrv+10401+3d549418
python3-lib389
Red Hat:directory_server:11.2::el8
before 0:1.4.3.21-3.module+el8dsrv+10401+3d549418
0:1.4.3.21-3.module+el8dsrv+10401+3d549418
389-ds-base
Red Hat:rhel_eus:8.2::appstream
before 0:1.4.2.4-13.module+el8.2.0+10648+abe88955
0:1.4.2.4-13.module+el8.2.0+10648+abe88955
389-ds-base-debuginfo
Red Hat:rhel_eus:8.2::appstream
before 0:1.4.2.4-13.module+el8.2.0+10648+abe88955
0:1.4.2.4-13.module+el8.2.0+10648+abe88955
389-ds-base-debugsource
Red Hat:rhel_eus:8.2::appstream
before 0:1.4.2.4-13.module+el8.2.0+10648+abe88955
0:1.4.2.4-13.module+el8.2.0+10648+abe88955
389-ds-base-devel
Red Hat:rhel_eus:8.2::appstream
before 0:1.4.2.4-13.module+el8.2.0+10648+abe88955
0:1.4.2.4-13.module+el8.2.0+10648+abe88955
389-ds-base-legacy-tools
Red Hat:rhel_eus:8.2::appstream
before 0:1.4.2.4-13.module+el8.2.0+10648+abe88955
0:1.4.2.4-13.module+el8.2.0+10648+abe88955
389-ds-base-legacy-tools-debuginfo
Red Hat:rhel_eus:8.2::appstream
before 0:1.4.2.4-13.module+el8.2.0+10648+abe88955
0:1.4.2.4-13.module+el8.2.0+10648+abe88955
389-ds-base-libs
Red Hat:rhel_eus:8.2::appstream
before 0:1.4.2.4-13.module+el8.2.0+10648+abe88955
0:1.4.2.4-13.module+el8.2.0+10648+abe88955
389-ds-base-libs-debuginfo
Red Hat:rhel_eus:8.2::appstream
before 0:1.4.2.4-13.module+el8.2.0+10648+abe88955
0:1.4.2.4-13.module+el8.2.0+10648+abe88955
389-ds-base-snmp
Red Hat:rhel_eus:8.2::appstream
before 0:1.4.2.4-13.module+el8.2.0+10648+abe88955
0:1.4.2.4-13.module+el8.2.0+10648+abe88955
389-ds-base-snmp-debuginfo
Red Hat:rhel_eus:8.2::appstream
before 0:1.4.2.4-13.module+el8.2.0+10648+abe88955
0:1.4.2.4-13.module+el8.2.0+10648+abe88955
python3-lib389
Red Hat:rhel_eus:8.2::appstream
before 0:1.4.2.4-13.module+el8.2.0+10648+abe88955
0:1.4.2.4-13.module+el8.2.0+10648+abe88955
389-ds-base
Red Hat:enterprise_linux:7::client
before 0:1.3.10.2-12.el7_9
0:1.3.10.2-12.el7_9
389-ds-base-debuginfo
Red Hat:enterprise_linux:7::client
before 0:1.3.10.2-12.el7_9
0:1.3.10.2-12.el7_9
389-ds-base-devel
Red Hat:enterprise_linux:7::client
before 0:1.3.10.2-12.el7_9
0:1.3.10.2-12.el7_9
389-ds-base-libs
Red Hat:enterprise_linux:7::client
before 0:1.3.10.2-12.el7_9
0:1.3.10.2-12.el7_9
389-ds-base-snmp
Red Hat:enterprise_linux:7::client
before 0:1.3.10.2-12.el7_9
0:1.3.10.2-12.el7_9
389-ds-base
Red Hat:enterprise_linux:7::computenode
before 0:1.3.10.2-12.el7_9
0:1.3.10.2-12.el7_9
389-ds-base-debuginfo
Red Hat:enterprise_linux:7::computenode
before 0:1.3.10.2-12.el7_9
0:1.3.10.2-12.el7_9
389-ds-base-devel
Red Hat:enterprise_linux:7::computenode
before 0:1.3.10.2-12.el7_9
0:1.3.10.2-12.el7_9
389-ds-base-libs
Red Hat:enterprise_linux:7::computenode
before 0:1.3.10.2-12.el7_9
0:1.3.10.2-12.el7_9
389-ds-base-snmp
Red Hat:enterprise_linux:7::computenode
before 0:1.3.10.2-12.el7_9
0:1.3.10.2-12.el7_9
389-ds-base
Red Hat:enterprise_linux:7::server
before 0:1.3.10.2-12.el7_9
0:1.3.10.2-12.el7_9
389-ds-base-debuginfo
Red Hat:enterprise_linux:7::server
before 0:1.3.10.2-12.el7_9
0:1.3.10.2-12.el7_9
389-ds-base-libs
Red Hat:enterprise_linux:7::server
before 0:1.3.10.2-12.el7_9
0:1.3.10.2-12.el7_9
389-ds-base-devel
Red Hat:enterprise_linux:7::server
before 0:1.3.10.2-12.el7_9
0:1.3.10.2-12.el7_9
389-ds-base-snmp
Red Hat:enterprise_linux:7::server
before 0:1.3.10.2-12.el7_9
0:1.3.10.2-12.el7_9
389-ds-base
Red Hat:enterprise_linux:7::workstation
before 0:1.3.10.2-12.el7_9
0:1.3.10.2-12.el7_9
389-ds-base-debuginfo
Red Hat:enterprise_linux:7::workstation
before 0:1.3.10.2-12.el7_9
0:1.3.10.2-12.el7_9
389-ds-base-libs
Red Hat:enterprise_linux:7::workstation
before 0:1.3.10.2-12.el7_9
0:1.3.10.2-12.el7_9
389-ds-base-devel
Red Hat:enterprise_linux:7::workstation
before 0:1.3.10.2-12.el7_9
0:1.3.10.2-12.el7_9
389-ds-base-snmp
Red Hat:enterprise_linux:7::workstation
before 0:1.3.10.2-12.el7_9
0:1.3.10.2-12.el7_9
389-ds
SUSE:Linux Enterprise Module for Server Applications 15 SP2
before 1.4.3.19~git0.bef0b5bed-3.12.1
1.4.3.19~git0.bef0b5bed-3.12.1
389-ds-base
Ubuntu:Pro:20.04:LTS
before 1.4.3.6-2ubuntu0.1~esm1, plus listed versions
1.4.1.6-41.4.1.6-4build11.4.2.4-11.4.2.4-1build11.4.3.2-11.4.3.2-1build11.4.3.6-2
1.4.3.6-2ubuntu0.1~esm1
389-ds-base
Ubuntu:Pro:16.04:LTS
From an advisory covering 2 CVEs
before 1.3.4.9-1ubuntu0.1~esm1, plus listed versions
1.3.3.12-1build11.3.3.13-11.3.4.5-21.3.4.8-11.3.4.8-31.3.4.8-3ubuntu11.3.4.8-41.3.4.9-1
1.3.4.9-1ubuntu0.1~esm1
389-ds-base
Ubuntu:Pro:18.04:LTS
From an advisory covering 2 CVEs
before 1.3.7.10-1ubuntu1+esm1, plus listed versions
1.3.7.5-11.3.7.5-1build11.3.7.5-1build21.3.7.9-11.3.7.10-11.3.7.10-1ubuntu1
1.3.7.10-1ubuntu1+esm1
389-ds-base
Ubuntu:Pro:20.04:LTS
From an advisory covering 2 CVEs
before 1.4.3.6-2ubuntu0.1~esm1, plus listed versions
1.4.1.6-41.4.1.6-4build11.4.2.4-11.4.2.4-1build11.4.3.2-11.4.3.2-1build11.4.3.6-2
1.4.3.6-2ubuntu0.1~esm1
389-ds
openSUSE:Leap 15.2
before 1.4.3.19~git0.bef0b5bed-lp152.2.12.1
1.4.3.19~git0.bef0b5bed-lp152.2.12.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-35518 is a medium vulnerability (CVSS 5.3) in Redhat 389 Directory Server, published March 8, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.54%, the 74th percentile. Fixed in 389-ds-base 1.4.4.10-1.

References

Show 40 moreShow less
MoveEnter Open