CVE-2026-14969
EUVD-2026-4205207.07.2026, 16:16
A flaw was found in 389-ds-base where the LDBM backend attribute encryption uses a hardcoded static initialization vector for AES-CBC and 3DES-CBC operations, allowing an attacker with privileged filesystem access to detect plaintext equality across encrypted entries by comparing ciphertext blocks.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| redhat | directory_server | 11.0 |
| redhat | directory_server | 12.0 |
| redhat | directory_server | 13.0 |
| redhat | 389_directory_server | - |
| redhat | enterprise_linux | 7.0 |
| redhat | enterprise_linux | 8.0 |
| redhat | enterprise_linux | 9.0 |
| redhat | enterprise_linux | 10.0 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases