CVE-2026-14969

Published: Jul 7, 2026Modified: Jul 9, 2026

4.4

Vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Exploitability: 0.8 / Impact: 3.6

Source: NVD

Description

A flaw was found in 389-ds-base where the LDBM backend attribute encryption uses a hardcoded static initialization vector for AES-CBC and 3DES-CBC operations, allowing an attacker with privileged filesystem access to detect plaintext equality across encrypted entries by comparing ciphertext blocks.

Affected (8)

Products: Redhat: 389 Directory Server, Directory Server, Enterprise Linux

3 products

Configuration A

8 vulnerable

Vulnerable Software	Affected Versions
Redhat 389 Directory Server	All versions
Redhat Directory Server	Version 11.0
Redhat Directory Server	Version 12.0
Redhat Directory Server	Version 13.0
Redhat Enterprise Linux	Version 10.0
Redhat Enterprise Linux	Version 7.0
Redhat Enterprise Linux	Version 8.0
Redhat Enterprise Linux	Version 9.0

Related CWEs

CWE-329

Generation of Predictable IV with CBC Mode

The product generates and uses a predictable initialization Vector (IV) with Cipher Block Chaining (CBC) Mode, which causes algorithms to be susceptible to dictionary attacks when they are encrypted under the same key.

References (2)

https://access.redhat.com/security/cve/CVE-2026-14969

Source: secalert@redhat.com

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2497735

Source: secalert@redhat.com

Issue TrackingVendor Advisory

Timeline

No history available yet.