Mercredi 8 juillet 2026

Red Hat Directory Server 11 · Red Hat Directory Server 12 · Red Hat Directory Server 13 · Red Hat Enterprise Linux 10

A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password verification function uses standard memcmp() for comparing password hashes instead of a constant-time comparison function. A remote attacker could potentially use timing measurements of LDAP bind attempts to infer partial hash information, though practical exploitation is extremely difficult due to PBKDF2 computational overhead.