{"id":"CVE-2022-1949","aliases":["DEBIAN-CVE-2022-1949","EUVD-2022-25217","GHSA-x847-vxvj-g6rj","MGASA-2022-0239","OESA-2024-2164","OESA-2024-2165","OESA-2024-2167","OESA-2024-2168","SUSE-SU-2022:2081-1","SUSE-SU-2022:2105-1","SUSE-SU-2022:2109-1","SUSE-SU-2022:2163-1","SUSE-SU-2022:2295-1","UBUNTU-CVE-2022-1949","openSUSE-SU-2024:12113-1"],"status":"published","title":"An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that...","description":"An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would yield incorrect results, but as that has progressed, can be determined that it actually is an access control bypass. This may allow any remote unauthenticated user to issue a filter that allows searching for database items they do not have access to, including but not limited to potentially userPassword hashes and other sensitive data.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01525,"percentile":0.74855,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-639","CWE-863"],"published":"2022-06-01T15:08:52Z","modified":"2026-11-03T08:00:30Z","fixes":[{"ecosystem":"Debian:12","package":"389-ds-base","fixed_in":["2.3.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"389-ds-base","fixed_in":["2.3.1-1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"389-ds-base","fixed_in":["1.4.0.26-8.5.mga8"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"389-ds","fixed_in":["2.1.1~git22.faef73366-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"389-ds-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"389-ds-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-1"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"389-ds-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0.26-8.5.mga8"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"three-eight-nine-ds-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"389-ds-base-1.4.3.36-6.oe2003sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"three-eight-nine-ds-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"389-ds-base-1.4.3.36-7.oe2203sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"three-eight-nine-ds-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"389-ds-base-1.4.3.36-7.oe2203sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"three-eight-nine-ds-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"389-ds-base-1.4.3.36-7.oe2203sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP3","package":"389-ds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4.19~git38.9951c1101-150300.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"389-ds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4.19~git38.9951c1101-150300.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"389-ds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3.30~git2.ca761af4b-150200.3.29.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"389-ds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3.30~git2.ca761af4b-150200.3.29.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"389-ds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3.30~git2.ca761af4b-150200.3.29.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"389-ds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3.30~git2.ca761af4b-150200.3.29.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"389-ds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3.30~git2.ca761af4b-150200.3.29.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"389-ds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3.30~git2.ca761af4b-150200.3.29.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"389-ds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3.30~git2.ca761af4b-150200.3.29.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"389-ds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3.30~git2.ca761af4b-150200.3.29.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"389-ds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3.30~git2.ca761af4b-150200.3.29.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"389-ds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0.31~git15.8b9843b0b-150000.4.27.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"389-ds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0.31~git15.8b9843b0b-150000.4.27.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"389-ds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0.31~git15.8b9843b0b-150000.4.27.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"389-ds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0.31~git15.8b9843b0b-150000.4.27.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"389-ds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2.16~git68.efa843752-150100.7.34.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"389-ds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2.16~git68.efa843752-150100.7.34.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"389-ds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2.16~git68.efa843752-150100.7.34.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"389-ds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2.16~git68.efa843752-150100.7.34.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"389-ds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2.16~git68.efa843752-150100.7.34.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"389-ds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2.16~git68.efa843752-150100.7.34.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP4","package":"389-ds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.15~git26.1ea6a6803-150400.3.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"389-ds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.15~git26.1ea6a6803-150400.3.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"389-ds-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.3.12-1build1","1.3.3.13-1","1.3.4.5-2","1.3.4.8-1","1.3.4.8-3","1.3.4.8-3ubuntu1","1.3.4.8-4","1.3.4.9-1","1.3.4.9-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"389-ds-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.7.5-1","1.3.7.5-1build1","1.3.7.5-1build2","1.3.7.9-1","1.3.7.10-1","1.3.7.10-1ubuntu1","1.3.7.10-1ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"389-ds-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.1.6-4","1.4.1.6-4build1","1.4.2.4-1","1.4.2.4-1build1","1.4.3.2-1","1.4.3.2-1build1","1.4.3.6-2","1.4.3.6-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"389-ds-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.4.11-2build1","1.4.4.11-2build2","1.4.4.17-1","2.0.11-2","2.0.14-1","2.0.15-1","2.0.15-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"389-ds-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.4+dfsg1-1","2.4.4+dfsg1-1ubuntu1","2.4.4+dfsg1-1ubuntu4","2.4.4+dfsg1-3","2.4.5+dfsg1-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"389-ds-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.2+dfsg1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"389-ds-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.2+vendor1-2","3.1.2+vendor1-2build1","3.3.1-3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"389-ds-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.2+dfsg1-1","3.1.2+vendor1-2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"389-ds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1~git22.faef73366-1.1"}]}]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"redhat","product":"389_directory_server"},{"vendor":"redhat","product":"directory_server"},{"vendor":"redhat","product":"enterprise_linux"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2091781","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1949","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-x847-vxvj-g6rj"},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-1949","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0239.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30558","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/X5QRVVCIHOYYKUM4VU2IZ3RYGYI66M2M/","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2164","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-5953","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2165","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2167","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2168","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222081-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1195324","tags":["report"]},{"url":"https://bugzilla.suse.com/1199889","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-4091","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-1949","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222105-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222109-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1188455","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3652","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222163-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1197275","tags":["report"]},{"url":"https://bugzilla.suse.com/1197345","tags":["report"]},{"url":"https://bugzilla.suse.com/1200175","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-0918","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-0996","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222295-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-1949","tags":["report"]},{"url":"https://github.com/389ds/389-ds-base/issues/5170","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-1949","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-1949","description":"An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would yield incorrect results, but as that has progressed, can be determined that it actually is an access control bypass. This may allow any remote unauthenticated user to issue a filter that allows searching for database items they do not have access to, including but not limited to potentially userPassword hashes and other sensitive data.","status":"published","published":"2022-06-01T15:08:52Z","modified":"2024-08-03T00:24:42.623Z","updated_at":"2026-11-02T14:34:38.263045Z"}],"euvd":[{"id":"EUVD-2022-25217","description":"An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would yield incorrect results, but as that has progressed, can be determined that it actually is an access control bypass. This may allow any remote unauthenticated user to issue a filter that allows searching for database items they do not have access to, including but not limited to potentially userPassword hashes and other sensitive data.","status":"published","published":"2022-06-01T15:08:52Z","modified":"2024-08-03T00:24:42Z","updated_at":"2026-11-03T03:25:59.498764Z"}],"ghsa":[{"id":"GHSA-x847-vxvj-g6rj","title":"An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that...","description":"An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would yield incorrect results, but as that has progressed, can be determined that it actually is an access control bypass. This may allow any remote unauthenticated user to issue a filter that allows searching for database items they do not have access to, including but not limited to potentially userPassword hashes and other sensitive data.","status":"published","published":"2022-06-03T00:01:01Z","modified":"2024-12-13T21:31:37Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-639","CWE-863"],"updated_at":"2026-11-02T14:59:11.49172Z"}],"nvd":[{"id":"CVE-2022-1949","description":"An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would yield incorrect results, but as that has progressed, can be determined that it actually is an access control bypass. This may allow any remote unauthenticated user to issue a filter that allows searching for database items they do not have access to, including but not limited to potentially userPassword hashes and other sensitive data.","status":"published","published":"2022-06-02T14:15:34.257Z","modified":"2026-06-17T04:23:24.67Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:07:21.261605Z"}],"osv":[{"id":"CVE-2022-1949","description":"An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would yield incorrect results, but as that has progressed, can be determined that it actually is an access control bypass. This may allow any remote unauthenticated user to issue a filter that allows searching for database items they do not have access to, including but not limited to potentially userPassword hashes and other sensitive data.","status":"published","published":"2022-06-02T14:15:34.257Z","modified":"2026-04-16T04:31:58.868049755Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:23.655778Z"},{"id":"DEBIAN-CVE-2022-1949","description":"An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would yield incorrect results, but as that has progressed, can be determined that it actually is an access control bypass. This may allow any remote unauthenticated user to issue a filter that allows searching for database items they do not have access to, including but not limited to potentially userPassword hashes and other sensitive data.","status":"published","published":"2022-06-02T14:15:34.257Z","modified":"2026-11-03T08:00:30.186806572Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-03T08:25:15.646766Z"},{"id":"OESA-2024-2164","title":"three-eight-nine-ds-base security update","description":"389-ds-base is an LDAPv3 compliant server which includes the LDAP server and command line utilities for server administration.\r\n\r\nSecurity Fix(es):\r\n\r\nAn access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would yield incorrect results, but as that has progressed, can be determined that it actually is an access control bypass. This may allow any remote unauthenticated user to issue a filter that allows searching for database items they do not have access to, including but not limited to potentially userPassword hashes and other sensitive data.(CVE-2022-1949)\r\n\r\nA denial of service vulnerability was found in the 389-ds-base LDAP server. This issue may allow an authenticated user to cause a server denial of service while attempting to log in with a user with a malformed hash in their password.(CVE-2024-5953)","status":"published","published":"2024-09-20T11:07:38Z","modified":"2026-08-18T01:17:33.058519967Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"OESA-2024-2165","title":"three-eight-nine-ds-base security update","description":"389-ds-base is an LDAPv3 compliant server which includes the LDAP server and command line utilities for server administration.\r\n\r\nSecurity Fix(es):\r\n\r\nAn access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would yield incorrect results, but as that has progressed, can be determined that it actually is an access control bypass. This may allow any remote unauthenticated user to issue a filter that allows searching for database items they do not have access to, including but not limited to potentially userPassword hashes and other sensitive data.(CVE-2022-1949)\r\n\r\nA denial of service vulnerability was found in the 389-ds-base LDAP server. This issue may allow an authenticated user to cause a server denial of service while attempting to log in with a user with a malformed hash in their password.(CVE-2024-5953)","status":"published","published":"2024-09-20T11:07:38Z","modified":"2026-08-18T01:17:33.036762748Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"OESA-2024-2167","title":"three-eight-nine-ds-base security update","description":"389-ds-base is an LDAPv3 compliant server which includes the LDAP server and command line utilities for server administration.\r\n\r\nSecurity Fix(es):\r\n\r\nAn access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would yield incorrect results, but as that has progressed, can be determined that it actually is an access control bypass. This may allow any remote unauthenticated user to issue a filter that allows searching for database items they do not have access to, including but not limited to potentially userPassword hashes and other sensitive data.(CVE-2022-1949)\r\n\r\nA denial of service vulnerability was found in the 389-ds-base LDAP server. This issue may allow an authenticated user to cause a server denial of service while attempting to log in with a user with a malformed hash in their password.(CVE-2024-5953)","status":"published","published":"2024-09-20T11:07:38Z","modified":"2026-08-18T01:17:32.884262729Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"OESA-2024-2168","title":"three-eight-nine-ds-base security update","description":"389-ds-base is an LDAPv3 compliant server which includes the LDAP server and command line utilities for server administration.\r\n\r\nSecurity Fix(es):\r\n\r\nAn access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would yield incorrect results, but as that has progressed, can be determined that it actually is an access control bypass. This may allow any remote unauthenticated user to issue a filter that allows searching for database items they do not have access to, including but not limited to potentially userPassword hashes and other sensitive data.(CVE-2022-1949)\r\n\r\nA denial of service vulnerability was found in the 389-ds-base LDAP server. This issue may allow an authenticated user to cause a server denial of service while attempting to log in with a user with a malformed hash in their password.(CVE-2024-5953)","status":"published","published":"2024-09-20T11:07:38Z","modified":"2026-08-18T01:17:33.252802848Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"UBUNTU-CVE-2022-1949","description":"An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would yield incorrect results, but as that has progressed, can be determined that it actually is an access control bypass. This may allow any remote unauthenticated user to issue a filter that allows searching for database items they do not have access to, including but not limited to potentially userPassword hashes and other sensitive data.","status":"published","published":"2022-06-02T14:15:00Z","modified":"2026-10-17T12:56:01.964928867Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T16:53:52.391598Z"},{"id":"MGASA-2022-0239","title":"Updated 389-ds-base packages fix security vulnerability","description":"An access control bypass vulnerability found in 389-ds-base. That\nmishandling of the filter that would yield incorrect results, but as that\nhas progressed, can be determined that it actually is an access control\nbypass. This may allow any remote unauthenticated user to issue a filter\nthat allows searching for database items they do not have access to,\nincluding but not limited to potentially userPassword hashes and other\nsensitive data. (CVE-2022-1949)\n","status":"published","published":"2022-06-24T20:50:43Z","modified":"2026-04-16T04:44:46.715832645Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2024:12113-1","title":"389-ds-2.1.1~git22.faef73366-1.1 on GA media","description":"These are all security issues fixed in the 389-ds-2.1.1~git22.faef73366-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:55:26.958681Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"SUSE-SU-2022:2081-1","title":"Security update for 389-ds","description":"This update for 389-ds fixes the following issues:\n\n- CVE-2021-4091: Fixed double free in psearch (bsc#1195324).\n- CVE-2022-1949: Fixed full access control bypass with simple crafted query (bsc#1199889).\n","status":"published","published":"2022-06-14T19:04:14Z","modified":"2026-02-04T04:19:34.888487Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"SUSE-SU-2022:2105-1","title":"Security update for 389-ds","description":"This update for 389-ds fixes the following issues:\n\n- CVE-2021-4091: Fixed double free in psearch (bsc#1195324).\n- CVE-2022-1949: Fixed full access control bypass with simple crafted query (bsc#1199889).\n","status":"published","published":"2022-06-16T13:22:49Z","modified":"2026-02-04T03:35:34.355778Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"SUSE-SU-2022:2109-1","title":"Security update for 389-ds","description":"This update for 389-ds fixes the following issues:\n\t  \n- CVE-2021-3652: Fixed disabled accounts may be able to bind with crypt passwords (bsc#1188455).  \n- CVE-2022-1949: Fixed full access control bypass with simple crafted query (bsc#1199889).\n- CVE-2021-4091: Fixed double free in psearch (bsc#1195324).\n","status":"published","published":"2022-06-16T13:26:57Z","modified":"2026-02-04T04:08:48.604246Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"SUSE-SU-2022:2163-1","title":"Security update for 389-ds","description":"This update for 389-ds fixes the following issues:\n\n- CVE-2022-1949: Fixed full access control bypass with simple crafted query (bsc#1199889).\n- CVE-2022-0918: Fixed denial of service issue via crafted messages (bsc#1197275).\n- CVE-2022-0996: Fixed mishandling of password expiry (bsc#1197345).\n- CVE-2021-4091: Fixed double free in psearch (bsc#1195324).\n- CVE-2021-3652: Fixed disabled accounts may be able to bind with crypt passwords (bsc#1188455). \n","status":"published","published":"2022-06-23T12:34:06Z","modified":"2026-02-04T03:18:11.555587Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"SUSE-SU-2022:2295-1","title":"Security update for 389-ds","description":"This update for 389-ds fixes the following issues:\n\n- CVE-2021-4091: Fixed double free in psearch (bsc#1195324).    \n- CVE-2022-1949: Fixed full access control bypass with simple crafted query (bsc#1199889).\n","status":"published","published":"2022-07-06T11:34:50Z","modified":"2026-02-04T02:18:50.212107Z","updated_at":"2026-11-02T15:53:50.965375Z"}]}}