CVSS: 5.5EPSS: 0%CPEs: 32EXPL: 0CVE-2024-1062 – 389-ds-base: a heap overflow leading to denail-of-servce while writing a value larger than 256 chars (in log_entry_attr)
https://notcve.org/view.php?id=CVE-2024-1062
12 Feb 2024 — A heap overflow flaw was found in 389-ds-base. This issue leads to a denial of service when writing a value larger than 256 chars in log_entry_attr. Se encontró una falla de desbordamiento de búfer de almacenamiento dinámico en 389-ds-base. Este problema provoca una denegación de servicio al escribir un valor superior a 256 caracteres en log_entry_attr. An update for the 389-ds:1.4 module is now available for Red Hat Enterprise Linux 8.8 Extended Update Support. • https://access.redhat.com/errata/RHSA-2024:1074 • CWE-122: Heap-based Buffer Overflow •
CVSS: 6.8EPSS: 0%CPEs: 10EXPL: 2CVE-2022-2850 – 389-ds-base: SIGSEGV in sync_repl
https://notcve.org/view.php?id=CVE-2022-2850
14 Oct 2022 — A flaw was found In 389-ds-base. When the Content Synchronization plugin is enabled, an authenticated user can reach a NULL pointer dereference using a specially crafted query. This flaw allows an authenticated attacker to cause a denial of service. This CVE is assigned against an incomplete fix of CVE-2021-3514. Se ha encontrado un fallo en 389-ds-base. • https://access.redhat.com/security/cve/CVE-2022-2850 • CWE-476: NULL Pointer Dereference •
CVSS: 7.5EPSS: 0%CPEs: 8EXPL: 0CVE-2022-1949
https://notcve.org/view.php?id=CVE-2022-1949
01 Jun 2022 — An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would yield incorrect results, but as that has progressed, can be determined that it actually is an access control bypass. This may allow any remote unauthenticated user to issue a filter that allows searching for database items they do not have access to, including but not limited to potentially userPassword hashes and other sensitive data. Una vulnerabilidad de omisión de control de acceso encontrada en 389-ds... • https://bugzilla.redhat.com/show_bug.cgi?id=2091781 • CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 1CVE-2022-0996 – 389-ds-base: expired password was still allowed to access the database
https://notcve.org/view.php?id=CVE-2022-0996
23 Mar 2022 — A vulnerability was found in the 389 Directory Server that allows expired passwords to access the database to cause improper authentication. Se encontró una vulnerabilidad en 389 Directory Server que permite que las contraseñas caducadas accedan a la base de datos para causar una autenticación inapropiada A vulnerability was found in the 389 Directory Server. This issue allows expired passwords to access the database, causing improper authentication. 389 Directory Server is an LDAP version 3 compliant serve... • https://bugzilla.redhat.com/show_bug.cgi?id=2064769 • CWE-287: Improper Authentication •
CVSS: 3.3EPSS: 0%CPEs: 4EXPL: 0CVE-2010-3282
https://notcve.org/view.php?id=CVE-2010-3282
09 Jan 2020 — 389 Directory Server before 1.2.7.1 (aka Red Hat Directory Server 8.2) and HP-UX Directory Server before B.08.10.03, when audit logging is enabled, logs the Directory Manager password (nsslapd-rootpw) in cleartext when changing cn=config:nsslapd-rootpw, which might allow local users to obtain sensitive information by reading the log. 389 Directory Server versiones anteriores a 1.2.7.1 (también se conoce como Red Hat Directory Server versión 8.2) y HP-UX Directory Server versiones anteriores a B.08.10.03, cu... • http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:6914 • CWE-312: Cleartext Storage of Sensitive Information •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2019-14824 – 389-ds-base: Read permission check bypass via the deref plugin
https://notcve.org/view.php?id=CVE-2019-14824
06 Nov 2019 — A flaw was found in the 'deref' plugin of 389-ds-base where it could use the 'search' permission to display attribute values. In some configurations, this could allow an authenticated attacker to view private attributes, such as password hashes. Se detectó un fallo en el plugin "deref" de 389-ds-base, donde podría usar el permiso "search" para mostrar los valores de los atributos. En algunas configuraciones, esto podría permitir a un atacante autenticado visualizar atributos privados, tales como hashes de c... • https://access.redhat.com/errata/RHSA-2019:3981 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 4.6EPSS: 0%CPEs: 1EXPL: 0CVE-2019-10224 – 389-ds-base: using dscreate in verbose mode results in information disclosure
https://notcve.org/view.php?id=CVE-2019-10224
06 Nov 2019 — A flaw has been found in 389-ds-base versions 1.4.x.x before 1.4.1.3. When executed in verbose mode, the dscreate and dsconf commands may display sensitive information, such as the Directory Manager password. An attacker, able to see the screen or record the terminal standard error output, could use this flaw to gain sensitive information. Se ha encontrado un fallo en 389-ds-base versiones 1.4.x.x anteriores a 1.4.1.3. Cuando se ejecuta en modo verbose, los comandos dscreate y dsconf pueden mostrar informac... • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10224 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-522: Insufficiently Protected Credentials •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2019-10171 – 389-ds-base: Insufficient fix for CVE-2018-14648 denial of service in RHEL-7.5
https://notcve.org/view.php?id=CVE-2019-10171
16 Jul 2019 — It was found that the fix for CVE-2018-14648 in 389-ds-base, versions 1.4.0.x before 1.4.0.17, was incorrectly applied in RHEL 7.5. An attacker would still be able to provoke excessive CPU consumption leading to a denial of service. Se detectó que la corrección para el CVE-2018-14648 en 389-ds-base, versiones 1.4.0.x anteriores a 1.4.0.17, se aplicó incorrectamente en RHEL versión 7.5. Un atacante podría aún ser capaz de provocar un consumo excesivo de CPU conllevando a una denegación de servicio. It was fo... • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10171 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2019-3883 – 389-ds-base: DoS via hanging secured connections
https://notcve.org/view.php?id=CVE-2019-3883
17 Apr 2019 — In 389-ds-base up to version 1.4.1.2, requests are handled by workers threads. Each sockets will be waited by the worker for at most 'ioblocktimeout' seconds. However this timeout applies only for un-encrypted requests. Connections using SSL/TLS are not taking this timeout into account during reads, and may hang longer.An unauthenticated attacker could repeatedly create hanging LDAP requests to hang all the workers, resulting in a Denial of Service. En 389-ds-base hasta la versión 1.4.1.2, las peticiones so... • https://access.redhat.com/errata/RHSA-2019:1896 • CWE-772: Missing Release of Resource after Effective Lifetime •
CVSS: 7.8EPSS: 10%CPEs: 3EXPL: 0CVE-2018-14648 – 389-ds-base: Mishandled search requests in servers/slapd/search.c:do_search() allows for denial of service
https://notcve.org/view.php?id=CVE-2018-14648
28 Sep 2018 — A flaw was found in 389 Directory Server. A specially crafted search query could lead to excessive CPU consumption in the do_search() function. An unauthenticated attacker could use this flaw to provoke a denial of service. Se ha descubierto un problema en 389 Directory Server. Una cadena de consulta especialmente manipulada podría conducir a un consumo de CPU excesivo en la función do_search(). • https://access.redhat.com/errata/RHSA-2018:3127 • CWE-400: Uncontrolled Resource Consumption •