Description
A vulnerability was found in the 389 Directory Server that allows expired passwords to access the database to cause improper authentication.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | 389-ds-base | 1.4 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 13 | 389-ds-base | 2.0.15-1 | — |
| Debian 12 | 389-ds-base | 2.0.15-1 | — |
| Debian 11 | 389-ds-base | 1.4.4.11-2+deb11u1 | DLA-4021-1 |
| Debian 10 | 389-ds-base | 1.4.0.21-1+deb10u1 | DLA-3399-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | 389-ds-base | No fix yet | — |
| Ubuntu 26.04 LTS | 389-ds-base | No fix yet | — |
| Ubuntu 25.10 | 389-ds-base | No fix yet | — |
| Ubuntu 24.04 LTS | 389-ds-base | No fix yet | — |
| Ubuntu 22.04 LTS | 389-ds-base | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | 389-ds-base | No fix yet | — |
| Ubuntu Pro 18.04 LTS | 389-ds-base | No fix yet | — |
| Ubuntu Pro 16.04 LTS | 389-ds-base | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | 389-ds-base +2 | 2.1.3-4.el9_1 | RHSA-2022:8162 |
| RHEL 8 | 389-ds-base +5 | 1.4.3.28-7.module+el8.6.0+15293+4900ec12 | RHSA-2022:5823 |
| RHEL 7 | 389-ds-base +3 | 1.3.10.2-16.el7_9 | RHSA-2022:5239 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.0 EUS | 389-ds-base +2 | 2.0.14-3.el9_0 | RHSA-2022:8976 |
| RHEL 8.4 EUS | 389-ds-base +5 | 1.4.3.16-21.module+el8.4.0+15657+e1585ac1 | RHSA-2022:5620 |
| Red Hat Directory Server 11 | 389-ds-base +6 | 1.4.3.31-6.module+el8dsrv+16980+c4b9cd33 | RHBA-2022:7929 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | 389-ds-base +2 | 2.1.3-4.el9_1 | ALSA-2022:8162 |
| AlmaLinux 8 | 389-ds-base +5 | 1.4.3.28-7.module_el8.6.0+3071+d20b1d7c | ALSA-2022:5823 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | 389-ds-base | 2.1.3-4.el9_1 | RLSA-2022:8162 |
| Rocky Linux 8 | 389-ds-base | 1.4.3.28-7.module+el8.6.0+994+f0479f39 | RLSA-2022:5823 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP3 | 389-ds | 1.4.4.19~git28.b12c72226-150300.3.12.1 | SUSE-SU-2022:1100-1 |
| SLES 15 SP2 | 389-ds | 1.4.3.29~git18.3fcd3b1bd-150200.3.24.1 | SUSE-SU-2022:1102-1 |
| SLES 15 SP1 | 389-ds | 1.4.2.16~git68.efa843752-150100.7.34.1 | SUSE-SU-2022:2163-1 |
| SLES 15 | 389-ds | 1.4.0.31~git13.e5e55afa0-150000.4.24.1 | SUSE-SU-2022:1139-1 |
Show 12 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP2 | 389-ds | 1.4.3.29~git18.3fcd3b1bd-150200.3.24.1 | SUSE-SU-2022:1102-1 |
| SLES for SAP 15 SP1 | 389-ds | 1.4.2.16~git68.efa843752-150100.7.34.1 | SUSE-SU-2022:2163-1 |
| SLES for SAP 15 | 389-ds | 1.4.0.31~git13.e5e55afa0-150000.4.24.1 | SUSE-SU-2022:1139-1 |
| SLE Real Time 15 SP2 | 389-ds | 1.4.3.29~git18.3fcd3b1bd-150200.3.24.1 | SUSE-SU-2022:1102-1 |
| SLE HPC 15 SP2 | 389-ds | 1.4.3.29~git18.3fcd3b1bd-150200.3.24.1 | SUSE-SU-2022:1102-1 |
| SLE HPC 15 SP1 | 389-ds | 1.4.2.16~git68.efa843752-150100.7.34.1 | SUSE-SU-2022:2163-1 |
| SLE HPC 15 | 389-ds | 1.4.0.31~git13.e5e55afa0-150000.4.24.1 | SUSE-SU-2022:1139-1 |
| SUSE Manager Server 4.1 | 389-ds | 1.4.3.29~git18.3fcd3b1bd-150200.3.24.1 | SUSE-SU-2022:1102-1 |
| SUSE Manager Retail Branch Server 4.1 | 389-ds | 1.4.3.29~git18.3fcd3b1bd-150200.3.24.1 | SUSE-SU-2022:1102-1 |
| SUSE Manager Proxy 4.1 | 389-ds | 1.4.3.29~git18.3fcd3b1bd-150200.3.24.1 | SUSE-SU-2022:1102-1 |
| SUSE Enterprise Storage 7 | 389-ds | 1.4.3.29~git18.3fcd3b1bd-150200.3.24.1 | SUSE-SU-2022:1102-1 |
| SUSE Enterprise Storage 6 | 389-ds | 1.4.2.16~git68.efa843752-150100.7.34.1 | SUSE-SU-2022:2163-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | 389-ds | 2.0.14~git25.e6431d959-1.1 | openSUSE-SU-2024:11952-1 |
| openSUSE Leap 15.3 | 389-ds | 1.4.4.19~git28.b12c72226-150300.3.12.1 | openSUSE-SU-2022:1100-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | 389-ds-base +3 | 1.3.10.2-16.amzn2.0.1 | ALAS2-2022-1819 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | 389-ds-base +2 | 2.1.3-4.el9_1 | ELSA-2022-8162 |
| Oracle Linux 8 | 389-ds-base +5 | 1.4.3.28-7.module+el8.6.0+20716+53f13155 | ELSA-2022-5823 |
| Oracle Linux 7 | 389-ds-base +3 | 1.3.10.2-16.el7_9 | ELSA-2022-5239 |
Advisories 23
- ALSA-2022:8162 Moderate: 389-ds-base security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2022:5823 Moderate: 389-ds:1.4 security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2022:8976 Red Hat Security Advisory: 389-ds-base security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHSA-2022:8162 Red Hat Security Advisory: 389-ds-base security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHSA-2022:5823 Red Hat Security Advisory: 389-ds:1.4 security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHSA-2022:5620 Red Hat Security Advisory: 389-ds:1.4 security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHSA-2022:5239 Red Hat Security Advisory: 389-ds-base security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHBA-2022:7929 Red Hat Bug Fix Advisory: redhat-ds:11 bug fix and enhancement update Red Hat Security Advisories (RHSA) · Apr 7, 2026
- DLA-3399-1 389-ds-base - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-4021-1 389-ds-base - security update Debian Security (DSA / DLA) · Mar 9, 2026
- RLSA-2022:5823 Moderate: 389-ds:1.4 security update Rocky Linux Security Advisories · Feb 5, 2026
- RLSA-2022:8162 Moderate: 389-ds-base security, bug fix, and enhancement update Rocky Linux Security Advisories · Feb 4, 2026
- SUSE-SU-2022:1100-1 Security update for 389-ds SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2022:1100-1 Security update for 389-ds SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:1102-1 Security update for 389-ds SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:1139-1 Security update for 389-ds SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:2163-1 Security update for 389-ds SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11952-1 389-ds-2.0.14~git25.e6431d959-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2022-0500 Red Hat Directory Server: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Dec 13, 2022
- ELSA-2022-8162 Moderate: 389-ds-base security, bug fix, and enhancement update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Nov 22, 2022
- ELSA-2022-5823 Moderate: 389-ds:1.4 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Aug 3, 2022
- ALAS2-2022-1819 Moderate: 389-ds-base security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jul 20, 2022
- ELSA-2022-5239 Moderate: 389-ds-base security, bug fix, and enhancement update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jun 29, 2022