Log in Start free

Vulnerability · Published Jun 18, 2024 · Assigned by redhat

CVE-2024-5953389-ds-base: malformed userpassword hash may cause denial of service

Medium 5.7

In plain English

A medium-severity security flaw in 389-ds-base. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.7Medium
Exploit odds (30 days)0.6%top 52.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A denial of service vulnerability was found in the 389-ds-base LDAP server. This issue may allow an authenticated user to cause a server denial of service while attempting to log in with a user with a malformed hash in their password.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8389-ds-base1.4.3.39-8.module_el8.10.0+3891+cbd883bfALSA-2024:6569
AlmaLinux:9389-ds-base2.4.5-9.el9_4ALSA-2024:5192
AlmaLinux:8389-ds-base-devel1.4.3.39-8.module_el8.10.0+3891+cbd883bfALSA-2024:6569
AlmaLinux:9389-ds-base-devel2.4.5-9.el9_4ALSA-2024:5192
AlmaLinux:8389-ds-base-legacy-tools1.4.3.39-8.module_el8.10.0+3891+cbd883bfALSA-2024:6569
AlmaLinux:8389-ds-base-libs1.4.3.39-8.module_el8.10.0+3891+cbd883bfALSA-2024:6569
AlmaLinux:9389-ds-base-libs2.4.5-9.el9_4ALSA-2024:5192
AlmaLinux:8389-ds-base-snmp1.4.3.39-8.module_el8.10.0+3891+cbd883bfALSA-2024:6569
AlmaLinux:8python3-lib3891.4.3.39-8.module_el8.10.0+3891+cbd883bfALSA-2024:6569
AlmaLinux:9python3-lib3892.4.5-9.el9_4ALSA-2024:5192
Debian:12389-ds-base2.3.1+dfsg1-1+deb12u1DEBIAN-CVE-2024-5953
Debian:13389-ds-base3.1.1+dfsg1-1DEBIAN-CVE-2024-5953
Rocky Linux:8389-ds-base0:1.4.3.39-8.module+el8.10.0+1866+6d9051ffRLSA-2024:6569
Rocky Linux:9389-ds-base0:2.4.5-9.el9_4RLSA-2024:5192
Ubuntu:22.04:LTS389-ds-baseno fix listedUBUNTU-CVE-2024-5953
Ubuntu:24.04:LTS389-ds-baseno fix listedUBUNTU-CVE-2024-5953
Ubuntu:25.10389-ds-baseno fix listedUBUNTU-CVE-2024-5953
Ubuntu:26.04:LTS389-ds-baseno fix listedUBUNTU-CVE-2024-5953
Ubuntu:26.10389-ds-baseno fix listedUBUNTU-CVE-2024-5953

Affected products (as reported)

VendorProductVersions
389-ds-base see references
Red Hat Red Hat Directory Server 11.5 E4S for RHEL 8 see references
Red Hat Red Hat Directory Server 11.7 for RHEL 8 see references
Red Hat Red Hat Directory Server 11.9 for RHEL 8 see references
Red Hat Red Hat Directory Server 12.2 EUS for RHEL 9 see references
Red Hat Red Hat Directory Server 12.4 for RHEL 9 see references
Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 8.8 Extended Update Support see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9.2 Extended Update Support see references
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 6 see references

Weakness: CWE-1288 · Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References