CVE-2026-15041

Description

A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password verification function uses standard memcmp() for comparing password hashes instead of a constant-time comparison function. A remote attacker could potentially use timing measurements of LDAP bind attempts to infer partial hash information, though practical exploitation is extremely difficult due to PBKDF2 computational overhead.

Traduire en français

Produits concernés

• Red Hat Directory Server 11
• Red Hat Directory Server 12
• Red Hat Directory Server 13
• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Red Hat Enterprise Linux 7
• Red Hat Enterprise Linux 8
• Red Hat Enterprise Linux 9
• Redhat directory server
• Redhat 389 directory server
• Redhat enterprise linux

Scores CVSS

Faiblesses (CWE)

• CWE-208

Références

• https://access.redhat.com/security/cve/CVE-2026-15041 Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2498022 Issue TrackingVendor Advisory

Ailleurs

• NVD
• CVE.org
• CIRCL Vulnerability-Lookup
• CERT-FR
• GitHub Advisories