rpm package
almalinux/389-ds-base
pkg:rpm/almalinux/389-ds-base
Vulnerabilities (11)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2025-14905 | Hig | 7.2 | < 2.7.0-10.el9_7 | 2.7.0-10.el9_7 | Feb 23, 2026 | A flaw was found in the 389-ds-base server. A heap buffer overflow vulnerability exists in the `schema_attr_enum_callback` function within the `schema.c` file. This occurs because the code incorrectly calculates the buffer size by summing alias string lengths without accounting f | |
| CVE-2025-2487 | Med | 4.9 | < 2.5.2-9.el9_5 | 2.5.2-9.el9_5 | Mar 18, 2025 | A flaw was found in the 389-ds-base LDAP Server. This issue occurs when issuing a Modify DN LDAP operation through the ldap protocol, when the function return value is not tested and a NULL pointer is dereferenced. If a privileged user performs a ldap MODDN operation after a fail | |
| CVE-2024-6237 | — | < 2.4.5-9.el9_4 | 2.4.5-9.el9_4 | Jul 9, 2024 | A flaw was found in the 389 Directory Server. This flaw allows an unauthenticated user to cause a systematic server crash while sending a specific extended search request, leading to a denial of service. | ||
| CVE-2024-5953 | Med | 5.7 | < 2.4.5-9.el9_4 | 2.4.5-9.el9_4 | Jun 18, 2024 | A denial of service vulnerability was found in the 389-ds-base LDAP server. This issue may allow an authenticated user to cause a server denial of service while attempting to log in with a user with a malformed hash in their password. | |
| CVE-2024-3657 | Hig | 7.5 | < 2.4.5-8.el9_4 | 2.4.5-8.el9_4 | May 28, 2024 | A flaw was found in 389-ds-base. A specially-crafted LDAP query can potentially cause a failure on the directory server, leading to a denial of service | |
| CVE-2024-2199 | Med | 5.7 | < 2.4.5-8.el9_4 | 2.4.5-8.el9_4 | May 28, 2024 | A denial of service vulnerability was found in 389-ds-base ldap server. This issue may allow an authenticated user to cause a server crash while modifying `userPassword` using malformed input. | |
| CVE-2024-1062 | — | < 1.4.3.39-3.module_el8.10.0+3829+ea459e35 | 1.4.3.39-3.module_el8.10.0+3829+ea459e35 | Feb 12, 2024 | A heap overflow flaw was found in 389-ds-base. This issue leads to a denial of service when writing a value larger than 256 chars in log_entry_attr. | ||
| CVE-2022-2850 | — | < 1.4.3.28-8.module_el8.6.0+3338+ebccfef1 | 1.4.3.28-8.module_el8.6.0+3338+ebccfef1 | Oct 14, 2022 | A flaw was found In 389-ds-base. When the Content Synchronization plugin is enabled, an authenticated user can reach a NULL pointer dereference using a specially crafted query. This flaw allows an authenticated attacker to cause a denial of service. This CVE is assigned against a | ||
| CVE-2022-0996 | — | < 1.4.3.28-7.module_el8.6.0+3071+d20b1d7c | 1.4.3.28-7.module_el8.6.0+3071+d20b1d7c | Mar 23, 2022 | A vulnerability was found in the 389 Directory Server that allows expired passwords to access the database to cause improper authentication. | ||
| CVE-2022-0918 | — | < 1.4.3.28-7.module_el8.6.0+3071+d20b1d7c | 1.4.3.28-7.module_el8.6.0+3071+d20b1d7c | Mar 16, 2022 | A vulnerability was discovered in the 389 Directory Server that allows an unauthenticated attacker with network access to the LDAP port to cause a denial of service. The denial of service is triggered by a single message sent over a TCP connection, no bind or other authentication | ||
| CVE-2021-4091 | — | < 1.4.3.23-14.module_el8.5.0+2628+c731dc97 | 1.4.3.23-14.module_el8.5.0+2628+c731dc97 | Feb 18, 2022 | A double-free was found in the way 389-ds-base handles virtual attributes context in persistent searches. An attacker could send a series of search requests, forcing the server to behave unexpectedly, and crash. |
- affected < 2.7.0-10.el9_7fixed 2.7.0-10.el9_7
A flaw was found in the 389-ds-base server. A heap buffer overflow vulnerability exists in the `schema_attr_enum_callback` function within the `schema.c` file. This occurs because the code incorrectly calculates the buffer size by summing alias string lengths without accounting f
- affected < 2.5.2-9.el9_5fixed 2.5.2-9.el9_5
A flaw was found in the 389-ds-base LDAP Server. This issue occurs when issuing a Modify DN LDAP operation through the ldap protocol, when the function return value is not tested and a NULL pointer is dereferenced. If a privileged user performs a ldap MODDN operation after a fail
- CVE-2024-6237Jul 9, 2024affected < 2.4.5-9.el9_4fixed 2.4.5-9.el9_4
A flaw was found in the 389 Directory Server. This flaw allows an unauthenticated user to cause a systematic server crash while sending a specific extended search request, leading to a denial of service.
- affected < 2.4.5-9.el9_4fixed 2.4.5-9.el9_4
A denial of service vulnerability was found in the 389-ds-base LDAP server. This issue may allow an authenticated user to cause a server denial of service while attempting to log in with a user with a malformed hash in their password.
- affected < 2.4.5-8.el9_4fixed 2.4.5-8.el9_4
A flaw was found in 389-ds-base. A specially-crafted LDAP query can potentially cause a failure on the directory server, leading to a denial of service
- affected < 2.4.5-8.el9_4fixed 2.4.5-8.el9_4
A denial of service vulnerability was found in 389-ds-base ldap server. This issue may allow an authenticated user to cause a server crash while modifying `userPassword` using malformed input.
- CVE-2024-1062Feb 12, 2024affected < 1.4.3.39-3.module_el8.10.0+3829+ea459e35fixed 1.4.3.39-3.module_el8.10.0+3829+ea459e35
A heap overflow flaw was found in 389-ds-base. This issue leads to a denial of service when writing a value larger than 256 chars in log_entry_attr.
- CVE-2022-2850Oct 14, 2022affected < 1.4.3.28-8.module_el8.6.0+3338+ebccfef1fixed 1.4.3.28-8.module_el8.6.0+3338+ebccfef1
A flaw was found In 389-ds-base. When the Content Synchronization plugin is enabled, an authenticated user can reach a NULL pointer dereference using a specially crafted query. This flaw allows an authenticated attacker to cause a denial of service. This CVE is assigned against a
- CVE-2022-0996Mar 23, 2022affected < 1.4.3.28-7.module_el8.6.0+3071+d20b1d7cfixed 1.4.3.28-7.module_el8.6.0+3071+d20b1d7c
A vulnerability was found in the 389 Directory Server that allows expired passwords to access the database to cause improper authentication.
- CVE-2022-0918Mar 16, 2022affected < 1.4.3.28-7.module_el8.6.0+3071+d20b1d7cfixed 1.4.3.28-7.module_el8.6.0+3071+d20b1d7c
A vulnerability was discovered in the 389 Directory Server that allows an unauthenticated attacker with network access to the LDAP port to cause a denial of service. The denial of service is triggered by a single message sent over a TCP connection, no bind or other authentication
- CVE-2021-4091Feb 18, 2022affected < 1.4.3.23-14.module_el8.5.0+2628+c731dc97fixed 1.4.3.23-14.module_el8.5.0+2628+c731dc97
A double-free was found in the way 389-ds-base handles virtual attributes context in persistent searches. An attacker could send a series of search requests, forcing the server to behave unexpectedly, and crash.