Read the docs
TI-2008-03145 Aliases CVE-2008-3283GHSA-vxv8-22w3-3cgm

Multiple memory leaks in Red Hat Directory Server 7.1 before SP7, Red Hat Directory…

Priority LOW 39CWE-399Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Complete
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-399 and the CVSS impact.

Summary

Multiple memory leaks in Red Hat Directory Server 7.1 before SP7, Red Hat Directory Server 8, and Fedora Directory Server 1.1.1 and earlier allow remote attackers to cause a denial of service (memory consumption) via vectors involving (1) the authentication / bind phase and (2) anonymous LDAP search requests.

Why it matters now

EPSS 0.02854 86th percentileScored 2026-11-07
Fix Fixed Red Hat: 3 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:a:fedora:directory_server:1.1.1:*:*:*:*:*:*:*1.1.1VulnerableFedora
cpe:2.3:a:redhat:directory_server:7.1:sp1:*:*:*:*:*:*7.1 sp1VulnerableRed Hat
cpe:2.3:a:redhat:directory_server:7.1:sp2:*:*:*:*:*:*7.1 sp2VulnerableRed Hat
cpe:2.3:a:redhat:directory_server:7.1:sp3:*:*:*:*:*:*7.1 sp3VulnerableRed Hat
cpe:2.3:a:redhat:directory_server:7.1:sp4:*:*:*:*:*:*7.1 sp4VulnerableRed Hat
cpe:2.3:a:redhat:directory_server:7.1:sp5:*:*:*:*:*:*7.1 sp5VulnerableRed Hat
cpe:2.3:a:redhat:directory_server:7.1:sp6:*:*:*:*:*:*7.1 sp6VulnerableRed Hat
cpe:2.3:a:redhat:directory_server:8.0:*:*:*:*:*:*:*8.0VulnerableRed Hat
  • cpe:2.3:a:fedora:directory_server:1.1.1:*:*:*:*:*:*:* Versions 1.1.1 Vulnerable ·Fedora
  • cpe:2.3:a:redhat:directory_server:7.1:sp1:*:*:*:*:*:* Versions 7.1 sp1 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:directory_server:7.1:sp2:*:*:*:*:*:* Versions 7.1 sp2 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:directory_server:7.1:sp3:*:*:*:*:*:* Versions 7.1 sp3 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:directory_server:7.1:sp4:*:*:*:*:*:* Versions 7.1 sp4 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:directory_server:7.1:sp5:*:*:*:*:*:* Versions 7.1 sp5 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:directory_server:7.1:sp6:*:*:*:*:*:* Versions 7.1 sp6 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:directory_server:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat

Remediation

Red Hat 3 advisories

  • RHSA-2008:0858 Released 2008-09-10 · Red Hat rating Moderate
    redhat-ds-base security and bug fix update
    • Red Hat IPA 1 for RHEL 5 Server redhat-ds-base-8.0.4-7.el5dsrv, redhat-ds-base-8.0.4-7.el5dsrv.i386, redhat-ds-base-devel-8.0.4-7.el5dsrv +1
  • RHSA-2008:0596 Released 2008-08-27 · Red Hat rating Critical
    Red Hat Directory Server 7.1 Service Pack 7 security update
    • RHEL 4 Directory Server AS redhat-ds-7.1SP7-14.RHEL4, redhat-ds-7.1SP7-14.RHEL4.i386
    • RHEL 4 Directory Server ES redhat-ds-7.1SP7-14.RHEL4, redhat-ds-7.1SP7-14.RHEL4.i386
    • Red Hat Directory Server 7.1 (for AS v. 3) redhat-ds-7.1SP7-14.RHEL3, redhat-ds-7.1SP7-14.RHEL3.i386
    • Red Hat Directory Server 7.1 (for ES v. 3) redhat-ds-7.1SP7-14.RHEL3, redhat-ds-7.1SP7-14.RHEL3.i386
  • RHSA-2008:0602 Released 2008-08-27 · Red Hat rating Moderate
    redhat-ds-base and redhat-ds-admin security and bug fix update
    • Red Hat Directory Server 8 (for RHEL 5 Server) redhat-ds-admin-8.0.4-3.el5dsrv, redhat-ds-admin-8.0.4-3.el5dsrv.i386, redhat-ds-base-8.0.4-7.el5dsrv +3

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
RHEL 4 Directory Server ASFixed RHSA-2008:0596
RHEL 4 Directory Server ESFixed RHSA-2008:0596
Red Hat Directory Server 7.1 (for AS v. 3)Fixed RHSA-2008:0596
Red Hat Directory Server 7.1 (for ES v. 3)Fixed RHSA-2008:0596
Red Hat Directory Server 8 (for RHEL 5 Server)Fixed RHSA-2008:0602
Not affected: 2 products
  • Red Hat Directory Server 8.0 (for AS v. 4)
  • Red Hat Directory Server 8.0 (for ES v. 4)

Timeline

  1. 2026-10-02 Threatist record created from CVE-2008-3283
  2. 2026-10-03 Alias added: GHSA-vxv8-22w3-3cgm

References

Patch 1

Advisory 6

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences