Strix
26.1K

CVE-2017-15135

UnknownEPSS 3.90%

Last modified

CVE-2017-15135 is a vulnerability of currently unknown severity. It was found that 389-ds-base since 1.3.6.1 up to and including 1.4.0.3 did not always handle internal hash comparison operations correctly during the authentication process. A remote, unauthenticated attacker could potentially use this flaw to bypass the authentication process under very rare and specific circumstances.. EPSS estimates a 3.90% chance of exploitation in the next 30 days.

Description

It was found that 389-ds-base since 1.3.6.1 up to and including 1.4.0.3 did not always handle internal hash comparison operations correctly during the authentication process. A remote, unauthenticated attacker could potentially use this flaw to bypass the authentication process under very rare and specific circumstances.

Metrics

EPSS Probability
3.90%

88.9th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
Fedoraproject389 Directory Server>= 1.3.6.1, <= 1.4.0.3

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2017-15135?
It was found that 389-ds-base since 1.3.6.1 up to and including 1.4.0.3 did not always handle internal hash comparison operations correctly during the authentication process. A remote, unauthenticated attacker could potentially use this flaw to bypass the authentication process under very rare and specific circumstances.
How severe is CVE-2017-15135?
Severity scoring for CVE-2017-15135 is pending analysis. The EPSS model estimates a 3.90% probability of exploitation in the next 30 days.
How do I fix CVE-2017-15135?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2017

View all 2017CVEs →

Are you affected by CVE-2017-15135?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST