Copyright © 2012 Red Hat, Inc. All rights reserved. Low 2026-07-08T09:58:21 389-ds-base: 389-ds-base: Non-constant-time comparison in PBKDF2-SHA256 password verification 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N CWE-208

A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password verification function uses standard memcmp() for comparing password hashes instead of a constant-time comparison function. A remote attacker could potentially use timing measurements of LDAP bind attempts to infer partial hash information, though practical exploitation is extremely difficult due to PBKDF2 computational overhead.

A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password verification function uses standard memcmp() for comparing password hashes instead of a constant-time comparison function. A remote attacker could potentially use timing measurements of LDAP bind attempts to infer partial hash information, though practical exploitation is extremely difficult due to PBKDF2 computational overhead.

Red Hat would like to thank Andrew Rukin (Arenadata) for reporting this issue. If possible, configure 389 Directory Server to use an alternative password storage scheme (e.g., SSHA512 or GOST-Yescrypt) which uses constant-time comparison. Red Hat Directory Server 11 Fix deferred redhat-ds:11/389-ds-base Red Hat Directory Server 12 Fix deferred redhat-ds:12/389-ds-base Red Hat Directory Server 13 Fix deferred 389-ds-base Red Hat Enterprise Linux 10 Fix deferred 389-ds-base Red Hat Enterprise Linux 6 Not affected 389-ds-base Red Hat Enterprise Linux 7 Fix deferred 389-ds-base Red Hat Enterprise Linux 8 Fix deferred 389-ds:1.4/389-ds-base Red Hat Enterprise Linux 9 Fix deferred 389-ds-base https://www.cve.org/CVERecord?id=CVE-2026-15041 https://nvd.nist.gov/vuln/detail/CVE-2026-15041