| Package | Affected versions | Patched versions |
|---|---|---|
| directory server | = 11.0= 12.0= 13.0 |
A flaw was found in 389-ds-base where the LDBM backend attribute encryption uses a hardcoded static initialization vector for AES-CBC and 3DES-CBC operations, allowing an attacker with privileged filesystem access to detect plaintext equality across encrypted entries by comparing ciphertext blocks.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free