CVE-2026-14969

4.4 Moyenne

Publiée le 07/07/2026 à 18:16 · Modifiée le 09/07/2026 à 22:16 · Analysée par le NVD · Source : secalert@redhat.com

Description

A flaw was found in 389-ds-base where the LDBM backend attribute encryption uses a hardcoded static initialization vector for AES-CBC and 3DES-CBC operations, allowing an attacker with privileged filesystem access to detect plaintext equality across encrypted entries by comparing ciphertext blocks.

Traduire en français

Produits concernés

Red Hat Directory Server 11
Red Hat Directory Server 12
Red Hat Directory Server 13
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9
Redhat directory server
Redhat 389 directory server
Redhat enterprise linux

Scores CVSS

Version	Score	Source	Vecteur
3.1	4.4 Moyenne	secalert@redhat.com	`CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N`
3.1	4.4 Moyenne	nvd@nist.gov (NVD)	`CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N`

Faiblesses (CWE)

CWE-329

Références

https://access.redhat.com/security/cve/CVE-2026-14969 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2497735 Issue TrackingVendor Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories