CVSS: 6.1EPSS: 0%CPEs: 5EXPL: 0CVE-2025-2487 – 389-ds-base: null pointer dereference leads to denial of service
https://notcve.org/view.php?id=CVE-2025-2487
18 Mar 2025 — A flaw was found in the 389-ds-base LDAP Server. This issue occurs when issuing a Modify DN LDAP operation through the ldap protocol, when the function return value is not tested and a NULL pointer is dereferenced. If a privileged user performs a ldap MODDN operation after a failed operation, it could lead to a Denial of Service (DoS) or system crash. • https://access.redhat.com/security/cve/CVE-2025-2487 • CWE-476: NULL Pointer Dereference •
CVSS: 5.7EPSS: 0%CPEs: 7EXPL: 0CVE-2024-8445 – 389-ds-base: server crash while modifying `userpassword` using malformed input (incomplete fix for cve-2024-2199)
https://notcve.org/view.php?id=CVE-2024-8445
05 Sep 2024 — The fix for CVE-2024-2199 in 389-ds-base was insufficient to cover all scenarios. In certain product versions, an authenticated user may cause a server crash while modifying `userPassword` using malformed input. An update for 389-ds-base is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. • https://access.redhat.com/security/cve/CVE-2024-8445 • CWE-20: Improper Input Validation •
CVSS: 6.8EPSS: 1%CPEs: 8EXPL: 0CVE-2024-6237 – 389-ds-base: unauthenticated user can trigger a dos by sending a specific extended search request
https://notcve.org/view.php?id=CVE-2024-6237
09 Jul 2024 — A flaw was found in the 389 Directory Server. This flaw allows an unauthenticated user to cause a systematic server crash while sending a specific extended search request, leading to a denial of service. • https://access.redhat.com/security/cve/CVE-2024-6237 • CWE-230: Improper Handling of Missing Values •
CVSS: 7.8EPSS: 0%CPEs: 26EXPL: 0CVE-2024-5953 – 389-ds-base: malformed userpassword hash may cause denial of service
https://notcve.org/view.php?id=CVE-2024-5953
18 Jun 2024 — A denial of service vulnerability was found in the 389-ds-base LDAP server. This issue may allow an authenticated user to cause a server denial of service while attempting to log in with a user with a malformed hash in their password. Se encontró una vulnerabilidad de denegación de servicio en el servidor LDAP 389-ds-base. Este problema puede permitir que un usuario autenticado provoque una denegación de servicio del servidor al intentar iniciar sesión con un usuario con un hash mal formado en su contraseña... • https://access.redhat.com/errata/RHSA-2024:4633 • CWE-1288: Improper Validation of Consistency within Input •
CVSS: 7.8EPSS: 2%CPEs: 24EXPL: 0CVE-2024-3657 – 389-ds-base: potential denial of service via specially crafted kerberos as-req request
https://notcve.org/view.php?id=CVE-2024-3657
28 May 2024 — A flaw was found in 389-ds-base. A specially-crafted LDAP query can potentially cause a failure on the directory server, leading to a denial of service Se encontró una falla en 389-ds-base. Una consulta LDAP especialmente manipulada puede causar potencialmente una falla en el servidor de directorio, lo que lleva a una denegación de servicio. An update for the redhat-ds:11 module is now available for Red Hat Directory Server 11.7 for RHEL 8. Issues addressed include a denial of service vulnerability. • https://access.redhat.com/errata/RHSA-2024:3591 • CWE-20: Improper Input Validation •
CVSS: 6.8EPSS: 0%CPEs: 21EXPL: 0CVE-2024-2199 – 389-ds-base: malformed userpassword may cause crash at do_modify in slapd/modify.c
https://notcve.org/view.php?id=CVE-2024-2199
28 May 2024 — A denial of service vulnerability was found in 389-ds-base ldap server. This issue may allow an authenticated user to cause a server crash while modifying `userPassword` using malformed input. Se encontró una vulnerabilidad de denegación de servicio en el servidor ldap 389-ds-base. Este problema puede permitir que un usuario autenticado provoque una falla del servidor al modificar "userPassword" utilizando una entrada con formato incorrecto. An update for the redhat-ds:11 module is now available for Red Hat... • https://access.redhat.com/errata/RHSA-2024:3591 • CWE-20: Improper Input Validation •
CVSS: 5.5EPSS: 0%CPEs: 32EXPL: 0CVE-2024-1062 – 389-ds-base: a heap overflow leading to denail-of-servce while writing a value larger than 256 chars (in log_entry_attr)
https://notcve.org/view.php?id=CVE-2024-1062
12 Feb 2024 — A heap overflow flaw was found in 389-ds-base. This issue leads to a denial of service when writing a value larger than 256 chars in log_entry_attr. Se encontró una falla de desbordamiento de búfer de almacenamiento dinámico en 389-ds-base. Este problema provoca una denegación de servicio al escribir un valor superior a 256 caracteres en log_entry_attr. An update for the 389-ds:1.4 module is now available for Red Hat Enterprise Linux 8.8 Extended Update Support. • https://access.redhat.com/errata/RHSA-2024:1074 • CWE-122: Heap-based Buffer Overflow •
CVSS: 5.5EPSS: 0%CPEs: 7EXPL: 0CVE-2023-1055 – RHDS: LDAP browser tries to decode userPassword instead of userCertificate attribute
https://notcve.org/view.php?id=CVE-2023-1055
27 Feb 2023 — A flaw was found in RHDS 11 and RHDS 12. While browsing entries LDAP tries to decode the userPassword attribute instead of the userCertificate attribute which could lead into sensitive information leaked. An attacker with a local account where the cockpit-389-ds is running can list the processes and display the hashed passwords. The highest threat from this vulnerability is to data confidentiality. A flaw was found in RHDS 11 and 12. • https://bugzilla.redhat.com/show_bug.cgi?id=2173517#c0 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-295: Improper Certificate Validation •
CVSS: 6.8EPSS: 0%CPEs: 10EXPL: 2CVE-2022-2850 – 389-ds-base: SIGSEGV in sync_repl
https://notcve.org/view.php?id=CVE-2022-2850
14 Oct 2022 — A flaw was found In 389-ds-base. When the Content Synchronization plugin is enabled, an authenticated user can reach a NULL pointer dereference using a specially crafted query. This flaw allows an authenticated attacker to cause a denial of service. This CVE is assigned against an incomplete fix of CVE-2021-3514. Se ha encontrado un fallo en 389-ds-base. • https://access.redhat.com/security/cve/CVE-2022-2850 • CWE-476: NULL Pointer Dereference •
CVSS: 7.5EPSS: 0%CPEs: 8EXPL: 0CVE-2022-1949
https://notcve.org/view.php?id=CVE-2022-1949
01 Jun 2022 — An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would yield incorrect results, but as that has progressed, can be determined that it actually is an access control bypass. This may allow any remote unauthenticated user to issue a filter that allows searching for database items they do not have access to, including but not limited to potentially userPassword hashes and other sensitive data. Una vulnerabilidad de omisión de control de acceso encontrada en 389-ds... • https://bugzilla.redhat.com/show_bug.cgi?id=2091781 • CWE-639: Authorization Bypass Through User-Controlled Key •