CVE-2026-15041 PUBLISHED

389-ds-base: 389-ds-base: non-constant-time comparison in pbkdf2-sha256 password verification

Assigner: redhat
Reserved: 08.07.2026 Published: 08.07.2026 Updated: 08.07.2026

A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password verification function uses standard memcmp() for comparing password hashes instead of a constant-time comparison function. A remote attacker could potentially use timing measurements of LDAP bind attempts to infer partial hash information, though practical exploitation is extremely difficult due to PBKDF2 computational overhead.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS Score: 3.7

Product Status

Vendor Red Hat
Product Red Hat Directory Server 11
Versions Default: affected
Vendor Red Hat
Product Red Hat Directory Server 12
Versions Default: affected
Vendor Red Hat
Product Red Hat Directory Server 13
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 10
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 6
Versions Default: unaffected
Vendor Red Hat
Product Red Hat Enterprise Linux 7
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 8
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 9
Versions Default: affected

Workarounds

If possible, configure 389 Directory Server to use an alternative password storage scheme (e.g., SSHA512 or GOST-Yescrypt) which uses constant-time comparison.

Credits

  • Red Hat would like to thank Andrew Rukin (Arenadata) for reporting this issue.

References

Problem Types

  • Observable Timing Discrepancy CWE