Description (CNA)
A flaw was found in 389-ds-base. The Cockpit 389 Console's LDAP editor constructs an ldapsearch command by embedding an LDAP entry's distinguished name (DN) into a shell command string without proper escaping. An LDAP user with delegated privileges to create or rename directory entries could craft a malicious DN containing shell metacharacters. When a Cockpit administrator subsequently views the entry in the 389 Console, the embedded shell command executes with root privileges on the directory server host.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Red Hat / Red Hat Directory Server 11.5 E4S for RHEL 8 | unaffected 8060020260908152739.0ca98e7e before * |
| Red Hat / Red Hat Directory Server 11.7 E4S for RHEL 8 | unaffected 8080020260903102346.f969626e before * |
| Red Hat / Red Hat Directory Server 11.9 for RHEL 8 | unaffected 8100020260904171440.37ed7c03 before * |
| Red Hat / Red Hat Directory Server 12.2 E4S for RHEL 9 | unaffected 9020020260903155914.1674d574 before * |
| Red Hat / Red Hat Directory Server 12.4 E4S for RHEL 9 | unaffected 9040020260903102623.1674d574 before * |
| Red Hat / Red Hat Directory Server 12.6 EUS for RHEL 9 | unaffected 9060020260903100230.1674d574 before * |
| Red Hat / Red Hat Directory Server 12.8 for RHEL 9 | unaffected 9080020260908092641.1674d574 before * |
| Red Hat / Red Hat Directory Server 13.0 EUS for RHEL 10 | unaffected 0:3.0.6-4.el10dsrv before * |
| Red Hat / Red Hat Directory Server 13.2 for RHEL 10 | unaffected 0:3.2.0-7.el10dsrv before * |
| Red Hat / Red Hat Directory Server 11 | affected |
| Red Hat / Red Hat Directory Server 12 | affected |
| Red Hat / Red Hat Enterprise Linux 10 | affected |
| Red Hat / Red Hat Enterprise Linux 6 | unknown |
| Red Hat / Red Hat Enterprise Linux 7 | unaffected |
| Red Hat / Red Hat Enterprise Linux 8 | affected |
| Red Hat / Red Hat Enterprise Linux 8 | unaffected |
| Red Hat / Red Hat Enterprise Linux 9 | affected |
CWE
CWE-78
References
- https://access.redhat.com/errata/RHSA-2026:64768
- https://access.redhat.com/errata/RHSA-2026:64769
- https://access.redhat.com/errata/RHSA-2026:64779
- https://access.redhat.com/errata/RHSA-2026:64780
- https://access.redhat.com/errata/RHSA-2026:64782
- https://access.redhat.com/errata/RHSA-2026:64792
- https://access.redhat.com/errata/RHSA-2026:64793
- https://access.redhat.com/errata/RHSA-2026:65375
- https://access.redhat.com/errata/RHSA-2026:79217
- https://access.redhat.com/security/cve/CVE-2026-19843
- https://bugzilla.redhat.com/show_bug.cgi?id=2515965
ADP enrichment
No English description supplied.
No references supplied.