CVE-2026-15041

Katalog CVE

CVSS 3.7 · Low EPSS 0,36%

Kerentanan Observable Timing Discrepancy pada redhat directory server, redhat 389 directory server +1 lainnya. Skor CVSS 3.1 3.7 (Low) menurut redhat.com.

Deskripsi (NVD)

A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password verification function uses standard memcmp() for comparing password hashes instead of a constant-time comparison function. A remote attacker could potentially use timing measurements of LDAP bind attempts to infer partial hash information, though practical exploitation is extremely difficult due to PBKDF2 computational overhead.

Rincian

Terbit di NVD

8 Juli 2026

Terakhir diubah

9 Juli 2026

Status NVD

Analyzed

CVSS 3.1

3.7 (Low), sumber redhat.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-208: Observable Timing Discrepancy

EPSS (30 hari)

0,36% peluang dieksploitasi; lebih tinggi dari 27,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/security/cve/CVE-2026-15041 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2498022 issue tracking · advisory vendor