CVE-2017-7551 389-ds-base version before 1.3.5.19 and 1.3.6.7 are vulnerable to password brute-force attacks during account lockout due to different return codes returned on password attempts.
CriticalCVSS 9.8
EPSS 1.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
389-ds-base version before 1.3.5.19 and 1.3.6.7 are vulnerable to password brute-force attacks during account lockout due to different return codes returned on password attempts.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/389-ds-base(Debian:12) | < 1.3.6.7-1 | 1.3.6.7-1 |
| debian/389-ds-base(Debian:13) | < 1.3.6.7-1 | 1.3.6.7-1 |
| fedoraproject 389 directory server | = 1.3.5.19 | No fix listed |
| fedoraproject 389 directory server | = 1.3.6.7 | No fix listed |
| ubuntu/389-ds-base(Ubuntu:26.04) | All versions | No fix listed |
| 389 Directory Server 389-ds-base | = before 1.3.5.19 and 1.3.6.7 | No fix listed |
References
- Debian Security Tracker CVE-2017-7551 vendor-advisory
- RHSA-2017:2569 vendor-advisory
- pagure.io exploit patch third-party-advisory
- Ubuntu CVE tracker vendor-advisory
- www.cve.org
- bugs.debian.org issue-tracking