CVE-2026-14969
MediumCVSS 4.4Exploitation Probability (EPSS)
Low risk0th percentile - higher than 0% of all known CVEs
Summary
A flaw was found in 389-ds-base where the LDBM backend attribute encryption uses a hardcoded static initialization vector for AES-CBC and 3DES-CBC operations, allowing an attacker with privileged filesystem access to detect plaintext equality across encrypted entries by comparing ciphertext blocks.
Risk Assessment
The organization is at risk of information leakage regarding data repetition in the LDAP database, potentially enabling pattern identification of attributes (e.g., passwords, keys) and weakening the confidentiality of stored data.
Recommendation
Immediately update 389-ds-base to a version that removes the hardcoded IV, and consider switching to an encryption mode with a random IV (e.g., AES-GCM).
Original NVD description (English source)
A flaw was found in 389-ds-base where the LDBM backend attribute encryption uses a hardcoded static initialization vector for AES-CBC and 3DES-CBC operations, allowing an attacker with privileged filesystem access to detect plaintext equality across encrypted entries by comparing ciphertext blocks.