Log in Start free

Vulnerability · Published May 28, 2024 · Assigned by redhat

CVE-2024-2199389-ds-base: malformed userpassword may cause crash at do_modify in slapd/modify.c

Medium 5.7

In plain English

A medium-severity improper input validation in 389-ds-base. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.7Medium
Exploit odds (30 days)0.6%top 52.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A denial of service vulnerability was found in 389-ds-base ldap server. This issue may allow an authenticated user to cause a server crash while modifying `userPassword` using malformed input.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8389-ds-base1.4.3.39-7.module_el8.10.0+3864+d8eec553ALSA-2024:4235
AlmaLinux:9389-ds-base2.4.5-8.el9_4ALSA-2024:3837
AlmaLinux:8389-ds-base-devel1.4.3.39-7.module_el8.10.0+3864+d8eec553ALSA-2024:4235
AlmaLinux:9389-ds-base-devel2.4.5-8.el9_4ALSA-2024:3837
AlmaLinux:8389-ds-base-legacy-tools1.4.3.39-7.module_el8.10.0+3864+d8eec553ALSA-2024:4235
AlmaLinux:8389-ds-base-libs1.4.3.39-7.module_el8.10.0+3864+d8eec553ALSA-2024:4235
AlmaLinux:9389-ds-base-libs2.4.5-8.el9_4ALSA-2024:3837
AlmaLinux:8389-ds-base-snmp1.4.3.39-7.module_el8.10.0+3864+d8eec553ALSA-2024:4235
AlmaLinux:8python3-lib3891.4.3.39-7.module_el8.10.0+3864+d8eec553ALSA-2024:4235
AlmaLinux:9python3-lib3892.4.5-8.el9_4ALSA-2024:3837
Debian:12389-ds-base2.3.1+dfsg1-1+deb12u1DEBIAN-CVE-2024-2199
Debian:13389-ds-base3.1.1+dfsg1-1DEBIAN-CVE-2024-2199
Rocky Linux:8389-ds-base0:1.4.3.39-7.module+el8.10.0+1832+2f5a9255RLSA-2024:4235
Rocky Linux:9389-ds-base0:2.4.5-8.el9_4RLSA-2024:3837
Ubuntu:22.04:LTS389-ds-baseno fix listedUBUNTU-CVE-2024-2199
Ubuntu:24.04:LTS389-ds-baseno fix listedUBUNTU-CVE-2024-2199
Ubuntu:25.10389-ds-baseno fix listedUBUNTU-CVE-2024-2199
Ubuntu:26.04:LTS389-ds-baseno fix listedUBUNTU-CVE-2024-2199
Ubuntu:26.10389-ds-baseno fix listedUBUNTU-CVE-2024-2199

Affected products (as reported)

VendorProductVersions
389-ds-base 0 – before 3.1.1
Red Hat Red Hat Directory Server 11.5 E4S for RHEL 8 see references
Red Hat Red Hat Directory Server 11.8 for RHEL 8 see references
Red Hat Red Hat Directory Server 11.9 for RHEL 8 see references
Red Hat Red Hat Directory Server 12.4 for RHEL 9 see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 8.8 Extended Update Support see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9.2 Extended Update Support see references
Red Hat Red Hat Enterprise Linux 6 see references

Weakness: CWE-20 · Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References