Vulnerability · Published May 28, 2021 · Assigned by redhat
CVE-2021-3514
Medium 6.5
In plain English
A medium-severity null pointer dereference in 389-ds-base. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 68% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)6.5Medium
Exploit odds (30 days)1.2%top 31.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
When using a sync_repl client in 389-ds-base, an authenticated attacker can cause a NULL pointer dereference using a specially crafted query, causing a crash.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | 389-ds-base | 1.4.4.11-2 | DEBIAN-CVE-2021-3514 |
| Debian:13 | 389-ds-base | 1.4.4.11-2 | DEBIAN-CVE-2021-3514 |
| Rocky Linux:8 | 389-ds-base | 0:1.4.3.16-16.module+el8.4.0+596+159889e5 | RLSA-2021:2595 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | 389-ds-base | 389-ds-base 1.4.3 |
Weakness: CWE-476