The vulnerability in 389-ds-base's Cockpit 389 Console LDAP editor arises from improper neutralization of special elements in an OS command (CWE-78). Specifically, the LDAP editor constructs an ldapsearch shell command embedding an LDAP entry's DN without escaping shell metacharacters. An LDAP user with delegated privileges to create or rename directory entries can insert shell metacharacters into the DN. When a Cockpit administrator views this entry, the shell command executes with root privileges on the directory server host. This leads to arbitrary command execution, compromising confidentiality, integrity, and availability of the host. Exploitation requires both delegated LDAP write privileges and a privileged Cockpit operator viewing the entry. The issue only affects Red Hat Directory Server deployments with the Cockpit 389 Console subpackage; plain RHEL 389-ds-base is not affected. No official fix or patch is currently confirmed. The vendor advisory recommends restricting access to trusted administrators and limiting delegated LDAP privileges until a fix is available.

Successful exploitation allows an attacker with delegated LDAP create or rename privileges to execute arbitrary OS commands with root privileges on the directory server host. This compromises the confidentiality, integrity, and availability of the host system. The attack requires a second condition: a privileged Cockpit administrator must view the malicious LDAP entry, triggering command execution. Neither condition alone is sufficient for exploitation. This vulnerability can lead to unauthorized code execution, data modification, and potential denial of service on the affected host.

No official fix or patch is currently available. Until a fix is released, Red Hat recommends restricting access to the Cockpit 389 Console to trusted administrators only and limiting delegated LDAP add/rename privileges to trusted accounts. This reduces the risk of exploitation by ensuring only trusted users can create or rename LDAP entries and only trusted operators can view them. Plain Red Hat Enterprise Linux installations without the Cockpit 389 Console subpackage are not affected and require no action.