Weak Encryption Vulnerability in 389-ds-base by Red Hat
CVE-2026-14969

4.4MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Directory Server 11
Red Hat Directory Server 12
Red Hat Directory Server 13
Red Hat Enterprise Linux 10
Vendor
CVE Published:
7 July 2026

What is CVE-2026-14969?

A significant vulnerability has been identified in the 389-ds-base where the attribute encryption mechanism for LDBM backend relies on a hardcoded static initialization vector for AES-CBC and 3DES-CBC encryption methods. This flaw enables an attacker with privileged filesystem access to recognize plaintext equality among encrypted entries by comparing ciphertext blocks, thereby potentially compromising the confidentiality of sensitive information. Administrators should apply available patches and review permissions to mitigate this risk.

References

https://access.redhat.com/security/cve/CVE-2026-14969
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2497735
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
4.4
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Andrew Rukin (Arenadata) for reporting this issue.
.