Red Hat Security Advisory

RHSA-2024:7458

redhat-ds:12 security update

Released 2024-10-01 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Directory Server 12.2 EUS for RHEL 9 389-ds-base-2.2.7-6.module+el9dsrv+22320+37c894f3.src::redhat-ds:12, 389-ds-base-2.2.7-6.module+el9dsrv+22320+37c894f3.x86_64::redhat-ds:12, 389-ds-base-devel-2.2.7-6.module+el9dsrv+22320+37c894f3.x86_64::redhat-ds:12 +4

Fixes 3 records

TI-2024-03412 CVE-2024-3657

389-ds-base: potential denial of service via specially crafted kerberos as-req request

MEDIUM 41

A flaw was found in 389-ds-base.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01282 Published 2024-05-28 Partial fix · 8060020250210084424.0ca98e7e, 8080020240909040333.f969626e +9 CWE-20

TI-2024-05517 CVE-2024-5953 · GHSA-9h7v-6cr6-hcpx

389-ds-base: malformed userpassword hash may cause denial of service

LOW 26

A denial of service vulnerability was found in the 389-ds-base LDAP server.

CVSS 3.1MEDIUM 5.7 Adjacent network Low privileges No interaction EPSS 0.00578 Published 2024-06-18 Partial fix · 8060020250210084424.0ca98e7e, 8080020240909040333.f969626e +8 CWE-1288

TI-2024-00983 CVE-2024-1062 · GHSA-6v6c-gc45-x65c

389-ds-base: a heap overflow leading to denail-of-servce while writing a value larger than 256 chars (in log_entry_attr)

LOW 25

A heap overflow flaw was found in 389-ds-base.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00307 Published 2024-02-12 Partial fix · 2.3.0, 8060020250210084424.0ca98e7e +7 CWE-122