{"id":"CVE-2017-7551","aliases":["DEBIAN-CVE-2017-7551","EUVD-2017-16559","GHSA-rr4q-qmwm-h86v","MGASA-2017-0340","RHSA-2017:2569","UBUNTU-CVE-2017-7551"],"status":"published","title":"389-ds-base version before 1.3.5.19 and 1.3.6.7 are vulnerable to password brute-force attacks...","description":"389-ds-base version before 1.3.5.19 and 1.3.6.7 are vulnerable to password brute-force attacks during account lockout due to different return codes returned on password attempts.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01418,"percentile":0.72956,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-209","CWE-640"],"published":"2017-08-16T18:00:00Z","modified":"2026-09-01T20:03:50Z","fixes":[{"ecosystem":"Debian:12","package":"389-ds-base","fixed_in":["1.3.6.7-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"389-ds-base","fixed_in":["1.3.6.7-1"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"389-ds-base","fixed_in":["1.3.4.14-1.3.mga5"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"389-ds-base","fixed_in":["1.3.5.17-1.1.mga6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"389-ds-base","fixed_in":["0:1.3.6.1-19.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"389-ds-base-debuginfo","fixed_in":["0:1.3.6.1-19.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"389-ds-base-devel","fixed_in":["0:1.3.6.1-19.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"389-ds-base-libs","fixed_in":["0:1.3.6.1-19.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"389-ds-base-snmp","fixed_in":["0:1.3.6.1-19.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"389-ds-base","fixed_in":["0:1.3.6.1-19.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"389-ds-base-debuginfo","fixed_in":["0:1.3.6.1-19.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"389-ds-base-devel","fixed_in":["0:1.3.6.1-19.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"389-ds-base-libs","fixed_in":["0:1.3.6.1-19.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"389-ds-base-snmp","fixed_in":["0:1.3.6.1-19.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"389-ds-base","fixed_in":["0:1.3.6.1-19.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"389-ds-base-debuginfo","fixed_in":["0:1.3.6.1-19.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"389-ds-base-libs","fixed_in":["0:1.3.6.1-19.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"389-ds-base-devel","fixed_in":["0:1.3.6.1-19.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"389-ds-base-snmp","fixed_in":["0:1.3.6.1-19.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"389-ds-base","fixed_in":["0:1.3.6.1-19.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"389-ds-base-debuginfo","fixed_in":["0:1.3.6.1-19.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"389-ds-base-libs","fixed_in":["0:1.3.6.1-19.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"389-ds-base-devel","fixed_in":["0:1.3.6.1-19.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"389-ds-base-snmp","fixed_in":["0:1.3.6.1-19.el7_4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"389-ds-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6.7-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"389-ds-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6.7-1"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"389-ds-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.4.14-1.3.mga5"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"389-ds-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5.17-1.1.mga6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"389-ds-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.6.1-19.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"389-ds-base-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.6.1-19.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"389-ds-base-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.6.1-19.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"389-ds-base-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.6.1-19.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"389-ds-base-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.6.1-19.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"389-ds-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.6.1-19.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"389-ds-base-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.6.1-19.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"389-ds-base-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.6.1-19.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"389-ds-base-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.6.1-19.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"389-ds-base-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.6.1-19.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"389-ds-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.6.1-19.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"389-ds-base-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.6.1-19.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"389-ds-base-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.6.1-19.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"389-ds-base-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.6.1-19.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"389-ds-base-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.6.1-19.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"389-ds-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.6.1-19.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"389-ds-base-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.6.1-19.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"389-ds-base-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.6.1-19.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"389-ds-base-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.6.1-19.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"389-ds-base-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.6.1-19.el7_4"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"389-ds-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.3.12-1build1","1.3.3.13-1","1.3.4.5-2","1.3.4.8-1","1.3.4.8-3","1.3.4.8-3ubuntu1","1.3.4.8-4","1.3.4.9-1","1.3.4.9-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"389-ds-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.2+dfsg1-1","3.1.2+vendor1-2"]}],"products":[{"vendor":"389 directory server","product":"389-ds-base"},{"vendor":"fedoraproject","product":"389_directory_server"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2017:2569","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://pagure.io/389-ds-base/issue/49336","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Patch","Third Party Advisory","fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-7551","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-7551","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1477669","tags":["report"]},{"url":"https://github.com/advisories/GHSA-rr4q-qmwm-h86v"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-7551","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2017-0340.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=21671","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1476161","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1476162","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1479755","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1479757","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1483865","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_2569.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-7551","tags":["advisory","report"]},{"url":"https://ubuntu.com/security/CVE-2017-7551","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-7551","description":"389-ds-base version before 1.3.5.19 and 1.3.6.7 are vulnerable to password brute-force attacks during account lockout due to different return codes returned on password attempts.","status":"published","published":"2017-08-16T18:00:00Z","modified":"2024-08-05T16:04:11.925Z","cwes":["CWE-209"],"updated_at":"2026-11-02T14:33:20.843976Z"}],"euvd":[{"id":"EUVD-2017-16559","description":"389-ds-base version before 1.3.5.19 and 1.3.6.7 are vulnerable to password brute-force attacks during account lockout due to different return codes returned on password attempts.","status":"published","published":"2017-08-16T18:00:00Z","modified":"2024-08-05T16:04:11Z","updated_at":"2026-11-03T02:39:08.024596Z"}],"ghsa":[{"id":"GHSA-rr4q-qmwm-h86v","title":"389-ds-base version before 1.3.5.19 and 1.3.6.7 are vulnerable to password brute-force attacks...","description":"389-ds-base version before 1.3.5.19 and 1.3.6.7 are vulnerable to password brute-force attacks during account lockout due to different return codes returned on password attempts.","status":"published","published":"2022-05-14T03:53:46Z","modified":"2023-02-13T00:31:00Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-209","CWE-640"],"updated_at":"2026-11-02T14:54:05.462623Z"}],"nvd":[{"id":"CVE-2017-7551","description":"389-ds-base version before 1.3.5.19 and 1.3.6.7 are vulnerable to password brute-force attacks during account lockout due to different return codes returned on password attempts.","status":"published","published":"2017-08-16T18:29:00.317Z","modified":"2026-06-17T01:24:35.62Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-209","CWE-640"],"updated_at":"2026-11-02T14:03:57.82609Z"}],"osv":[{"id":"CVE-2017-7551","description":"389-ds-base version before 1.3.5.19 and 1.3.6.7 are vulnerable to password brute-force attacks during account lockout due to different return codes returned on password attempts.","status":"published","published":"2017-08-16T18:29:00.317Z","modified":"2026-04-16T06:25:40.976670137Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:06.412595Z"},{"id":"DEBIAN-CVE-2017-7551","description":"389-ds-base version before 1.3.5.19 and 1.3.6.7 are vulnerable to password brute-force attacks during account lockout due to different return codes returned on password attempts.","status":"published","published":"2017-08-16T18:29:00.317Z","modified":"2026-09-01T20:03:50.2022854Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:29.412243Z"},{"id":"RHSA-2017:2569","title":"Red Hat Security Advisory: 389-ds-base security and bug fix update","status":"published","published":"2024-09-16T00:28:33Z","modified":"2026-06-26T12:22:01.169811123Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:04.262457Z"},{"id":"UBUNTU-CVE-2017-7551","description":"389-ds-base version before 1.3.5.19 and 1.3.6.7 are vulnerable to password brute-force attacks during account lockout due to different return codes returned on password attempts.","status":"published","published":"2017-08-16T18:29:00Z","modified":"2026-05-20T16:03:22.197929357Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:15.773974Z"},{"id":"MGASA-2017-0340","title":"Updated 389-ds-base packages fix security vulnerability","description":"The directory server password lockout policy prevents binds from\noperating once a threshold of failed passwords has been met. During this\nlockout, if you bind with a successful password, a different error code\nis returned. This means that an attacker has no ratelimit or penalty\nduring an account lock, and can continue to attempt passwords via\nbruteforce, using the change in return code to ascertain a sucessful\npassword auth (CVE-2017-7551).\n","status":"published","published":"2017-09-16T08:24:57Z","modified":"2026-04-16T06:25:09.663026077Z","updated_at":"2026-11-02T15:49:40.442238Z"}]}}