https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 02:31:25 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-19843 <p>A flaw was found in 389-ds-base. The Cockpit 389 Console&#39;s LDAP editor constructs an ldapsearch command by embedding an LDAP entry&#39;s distinguished name (DN) into a shell command string without proper escaping. An LDAP user with delegated privileges to create or rename directory entries could craft a malicious DN containing shell metacharacters. When a Cockpit administrator subsequently views the entry in the 389 Console, the embedded shell command executes with root privileges on the directory server host.</p> <p>A flaw was found in 389-ds-base. The Cockpit 389 Console&#39;s LDAP editor constructs an ldapsearch command by embedding an LDAP entry&#39;s distinguished name (DN) into a shell command string without proper escaping. An LDAP user with delegated privileges to create or rename directory entries could craft a malicious DN containing shell metacharacters. When a Cockpit administrator subsequently views the entry in the 389 Console, the embedded shell command executes with root privileges on the directory server host.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-19843 https://vulnerability.circl.lu/vuln/ghsa-p34m-7cj2-q64p <p>A flaw was found in 389-ds-base. The Cockpit 389 Console&#39;s LDAP editor constructs an ldapsearch command by embedding an LDAP entry&#39;s distinguished name (DN) into a shell command string without proper escaping. An LDAP user with delegated privileges to create or rename directory entries could craft a malicious DN containing shell metacharacters. When a Cockpit administrator subsequently views the entry in the 389 Console, the embedded shell command executes with root privileges on the directory server host.</p> <p>A flaw was found in 389-ds-base. The Cockpit 389 Console&#39;s LDAP editor constructs an ldapsearch command by embedding an LDAP entry&#39;s distinguished name (DN) into a shell command string without proper escaping. An LDAP user with delegated privileges to create or rename directory entries could craft a malicious DN containing shell metacharacters. When a Cockpit administrator subsequently views the entry in the 389 Console, the embedded shell command executes with root privileges on the directory server host.</p> https://vulnerability.circl.lu/vuln/ghsa-p34m-7cj2-q64p https://vulnerability.circl.lu/vuln/rhsa-2026:64768 <p>389-ds-base: 389-ds-base: Command injection via unescaped LDAP DN in Cockpit 389 Console LDAP editor</p> <p>389-ds-base: 389-ds-base: Command injection via unescaped LDAP DN in Cockpit 389 Console LDAP editor</p> https://vulnerability.circl.lu/vuln/rhsa-2026:64768 https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-19843 <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: 389-ds-base, Ubuntu:Pro:18.04:LTS: 389-ds-base, Ubuntu:Pro:20.04:LTS: 389-ds-base, Ubuntu:22.04:LTS: 389-ds-base, Ubuntu:24.04:LTS: 389-ds-base, Ubuntu:26.04:LTS: 389-ds-base</p> <p>A flaw was found in 389-ds-base. The Cockpit 389 Console&#39;s LDAP editor constructs an ldapsearch command by embedding an LDAP entry&#39;s distinguished name (DN) into a shell command string without proper escaping. An LDAP user with delegated privileges to create or rename directory entries could craft a malicious DN containing shell metacharacters. When a Cockpit administrator subsequently views the entry in the 389 Console, the embedded shell command executes with root privileges on the directory server host.</p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: 389-ds-base, Ubuntu:Pro:18.04:LTS: 389-ds-base, Ubuntu:Pro:20.04:LTS: 389-ds-base, Ubuntu:22.04:LTS: 389-ds-base, Ubuntu:24.04:LTS: 389-ds-base, Ubuntu:26.04:LTS: 389-ds-base</p> <p>A flaw was found in 389-ds-base. The Cockpit 389 Console&#39;s LDAP editor constructs an ldapsearch command by embedding an LDAP entry&#39;s distinguished name (DN) into a shell command string without proper escaping. An LDAP user with delegated privileges to create or rename directory entries could craft a malicious DN containing shell metacharacters. When a Cockpit administrator subsequently views the entry in the 389 Console, the embedded shell command executes with root privileges on the directory server host.</p> https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-19843 https://vulnerability.circl.lu/vuln/wid-sec-w-2026-3215 <p>Ein Angreifer kann mehrere Schwachstellen in Red Hat Directory Server und Red Hat Enterprise Linux ausnutzen, um beliebigen Code auszuführen, Administratorrechte zu erlangen, Daten zu manipulieren oder einen Denial-of-Service-Zustand auszulösen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Red Hat Directory Server und Red Hat Enterprise Linux ausnutzen, um beliebigen Code auszuführen, Administratorrechte zu erlangen, Daten zu manipulieren oder einen Denial-of-Service-Zustand auszulösen.</p> https://vulnerability.circl.lu/vuln/wid-sec-w-2026-3215