CVE-2026-14969

Summary

A flaw was found in 389-ds-base where the LDBM backend attribute encryption uses a hardcoded static initialization vector for AES-CBC and 3DES-CBC operations, allowing an attacker with privileged filesystem access to detect plaintext equality across encrypted entries by comparing ciphertext blocks.

Affected Software

Weaknesses

• CWE-329: Generation of Predictable IV with CBC Mode

Workarounds

Disable attribute encryption if it is not required for the deployment. If attribute encryption is required, restrict filesystem access to the LDBM database directory (/var/lib/dirsrv/slapd-<instance>/db/) to ensure only authorized administrators can read database files.

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: partial

References

• https://access.redhat.com/security/cve/CVE-2026-14969
• https://bugzilla.redhat.com/show_bug.cgi?id=2497735

• ←Previous
• Next→