VDB
DEBIAN-CVE-2021-3652
DEBIAN-CVE-2021-3652
PUBLISHED
CVSS 6.5 MEDIUM
Record from OSV · Published April 18, 2022
A flaw was found in 389-ds-base. If an asterisk is imported as password hashes, either accidentally or maliciously, then instead of being inactive, any password will successfully match during authentication. This flaw allows an attacker to successfully authenticate as a user whose password was disabled.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| 389-ds-base | Debian:12 | 1.4.4.17-1 |
| 389-ds-base | Debian:13 | 1.4.4.17-1 |
Risk scores
CVSS 3.1
6.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Debian:12 | 389-ds-base | 0 |
| Debian:13 | 389-ds-base | 0 |
Timeline
- Apr 18, 2022 CVE Published
- Oct 23, 2026 CVE Updated
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln DEBIAN-CVE-2021-3652
vulnetix vdb fixes DEBIAN-CVE-2021-3652Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/DEBIAN-CVE-2021-3652/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart