rpm package
almalinux/389-ds-base-legacy-tools
pkg:rpm/almalinux/389-ds-base-legacy-tools
Vulnerabilities (9)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2025-14905 | Hig | 7.2 | < 1.4.3.39-23.module_el8.10.0+4139+ef6adba4 | 1.4.3.39-23.module_el8.10.0+4139+ef6adba4 | Feb 23, 2026 | A flaw was found in the 389-ds-base server. A heap buffer overflow vulnerability exists in the `schema_attr_enum_callback` function within the `schema.c` file. This occurs because the code incorrectly calculates the buffer size by summing alias string lengths without accounting f | |
| CVE-2024-5953 | Med | 5.7 | < 1.4.3.39-8.module_el8.10.0+3891+cbd883bf | 1.4.3.39-8.module_el8.10.0+3891+cbd883bf | Jun 18, 2024 | A denial of service vulnerability was found in the 389-ds-base LDAP server. This issue may allow an authenticated user to cause a server denial of service while attempting to log in with a user with a malformed hash in their password. | |
| CVE-2024-3657 | Hig | 7.5 | < 1.4.3.39-7.module_el8.10.0+3864+d8eec553 | 1.4.3.39-7.module_el8.10.0+3864+d8eec553 | May 28, 2024 | A flaw was found in 389-ds-base. A specially-crafted LDAP query can potentially cause a failure on the directory server, leading to a denial of service | |
| CVE-2024-2199 | Med | 5.7 | < 1.4.3.39-7.module_el8.10.0+3864+d8eec553 | 1.4.3.39-7.module_el8.10.0+3864+d8eec553 | May 28, 2024 | A denial of service vulnerability was found in 389-ds-base ldap server. This issue may allow an authenticated user to cause a server crash while modifying `userPassword` using malformed input. | |
| CVE-2024-1062 | — | < 1.4.3.39-3.module_el8.10.0+3829+ea459e35 | 1.4.3.39-3.module_el8.10.0+3829+ea459e35 | Feb 12, 2024 | A heap overflow flaw was found in 389-ds-base. This issue leads to a denial of service when writing a value larger than 256 chars in log_entry_attr. | ||
| CVE-2022-2850 | — | < 1.4.3.28-8.module_el8.6.0+3338+ebccfef1 | 1.4.3.28-8.module_el8.6.0+3338+ebccfef1 | Oct 14, 2022 | A flaw was found In 389-ds-base. When the Content Synchronization plugin is enabled, an authenticated user can reach a NULL pointer dereference using a specially crafted query. This flaw allows an authenticated attacker to cause a denial of service. This CVE is assigned against a | ||
| CVE-2022-0996 | — | < 1.4.3.28-7.module_el8.6.0+3071+d20b1d7c | 1.4.3.28-7.module_el8.6.0+3071+d20b1d7c | Mar 23, 2022 | A vulnerability was found in the 389 Directory Server that allows expired passwords to access the database to cause improper authentication. | ||
| CVE-2022-0918 | — | < 1.4.3.28-7.module_el8.6.0+3071+d20b1d7c | 1.4.3.28-7.module_el8.6.0+3071+d20b1d7c | Mar 16, 2022 | A vulnerability was discovered in the 389 Directory Server that allows an unauthenticated attacker with network access to the LDAP port to cause a denial of service. The denial of service is triggered by a single message sent over a TCP connection, no bind or other authentication | ||
| CVE-2021-4091 | — | < 1.4.3.23-14.module_el8.5.0+2628+c731dc97 | 1.4.3.23-14.module_el8.5.0+2628+c731dc97 | Feb 18, 2022 | A double-free was found in the way 389-ds-base handles virtual attributes context in persistent searches. An attacker could send a series of search requests, forcing the server to behave unexpectedly, and crash. |
- affected < 1.4.3.39-23.module_el8.10.0+4139+ef6adba4fixed 1.4.3.39-23.module_el8.10.0+4139+ef6adba4
A flaw was found in the 389-ds-base server. A heap buffer overflow vulnerability exists in the `schema_attr_enum_callback` function within the `schema.c` file. This occurs because the code incorrectly calculates the buffer size by summing alias string lengths without accounting f
- affected < 1.4.3.39-8.module_el8.10.0+3891+cbd883bffixed 1.4.3.39-8.module_el8.10.0+3891+cbd883bf
A denial of service vulnerability was found in the 389-ds-base LDAP server. This issue may allow an authenticated user to cause a server denial of service while attempting to log in with a user with a malformed hash in their password.
- affected < 1.4.3.39-7.module_el8.10.0+3864+d8eec553fixed 1.4.3.39-7.module_el8.10.0+3864+d8eec553
A flaw was found in 389-ds-base. A specially-crafted LDAP query can potentially cause a failure on the directory server, leading to a denial of service
- affected < 1.4.3.39-7.module_el8.10.0+3864+d8eec553fixed 1.4.3.39-7.module_el8.10.0+3864+d8eec553
A denial of service vulnerability was found in 389-ds-base ldap server. This issue may allow an authenticated user to cause a server crash while modifying `userPassword` using malformed input.
- CVE-2024-1062Feb 12, 2024affected < 1.4.3.39-3.module_el8.10.0+3829+ea459e35fixed 1.4.3.39-3.module_el8.10.0+3829+ea459e35
A heap overflow flaw was found in 389-ds-base. This issue leads to a denial of service when writing a value larger than 256 chars in log_entry_attr.
- CVE-2022-2850Oct 14, 2022affected < 1.4.3.28-8.module_el8.6.0+3338+ebccfef1fixed 1.4.3.28-8.module_el8.6.0+3338+ebccfef1
A flaw was found In 389-ds-base. When the Content Synchronization plugin is enabled, an authenticated user can reach a NULL pointer dereference using a specially crafted query. This flaw allows an authenticated attacker to cause a denial of service. This CVE is assigned against a
- CVE-2022-0996Mar 23, 2022affected < 1.4.3.28-7.module_el8.6.0+3071+d20b1d7cfixed 1.4.3.28-7.module_el8.6.0+3071+d20b1d7c
A vulnerability was found in the 389 Directory Server that allows expired passwords to access the database to cause improper authentication.
- CVE-2022-0918Mar 16, 2022affected < 1.4.3.28-7.module_el8.6.0+3071+d20b1d7cfixed 1.4.3.28-7.module_el8.6.0+3071+d20b1d7c
A vulnerability was discovered in the 389 Directory Server that allows an unauthenticated attacker with network access to the LDAP port to cause a denial of service. The denial of service is triggered by a single message sent over a TCP connection, no bind or other authentication
- CVE-2021-4091Feb 18, 2022affected < 1.4.3.23-14.module_el8.5.0+2628+c731dc97fixed 1.4.3.23-14.module_el8.5.0+2628+c731dc97
A double-free was found in the way 389-ds-base handles virtual attributes context in persistent searches. An attacker could send a series of search requests, forcing the server to behave unexpectedly, and crash.