CVE-2017-15135: fedoraproject 389_directory_server Improper Authentication
Vulnerability summary
CVE-2017-15135 is a high (CVSS 8.1) Improper Authentication vulnerability in fedoraproject 389_directory_server. EPSS estimates a 3.83% chance of exploitation in the next 30 days, higher than 89.9% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 5 · Related 3Timeline
- 24-01-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
It was found that 389-ds-base since 1.3.6.1 up to and including 1.4.0.3 did not always handle internal hash comparison operations correctly during the authentication process. A remote, unauthenticated attacker could potentially use this flaw to bypass the authentication process under very rare and specific circumstances.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated8.1HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.1HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
3.83%
Chance of exploitation in the next 30 days
Percentile
90%
Versus all other CVEs
30-day change
0.00 pp
From 3.83% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian1 product
- 389-ds-base< 1.3.7.9-1
Fedoraproject1 product
- 389_directory_server≥ 1.3.6.1, ≤ 1.4.0.3
Mageia1 product
- 389-ds-base< 1.3.5.17-1.4.mga6
Red hat, inc.1 product
- 389-ds-basesince 1.3.6.1 up to and including 1.4.0.3
Ubuntu1 product
- 389-ds-base< 1.3.7.10-1ubuntu1
5 vendors · 5 products
References
11 links- bugzilla.redhat.com/show_bug.cgi?id=1525628X Refsource CONFIRMIssue TrackingPatchThird Party AdvisoryREPORT
