389-ds-base: malformed userpassword hash may cause denial of service
Priority LOW 26CWE-1288Published · Updated
Key facts
- Attack vector
- Adjacent network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 12 fixed, 1 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.
Summary
A denial of service vulnerability was found in the 389-ds-base LDAP server. This issue may allow an authenticated user to cause a server denial of service while attempting to log in with a user with a malformed hash in their password.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00578 47th percentileScored 2026-11-07
Fix Partial Red Hat: 10 advisoriesRed Hat: 12 fixed, 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | 389-ds-base | — | — | No fix listed | CNA |
| Red Hat | Red Hat Directory Server 11.5 E4S for RHEL 8 | — | 8060020250210084424.0ca98e7e | Patch available | CNA |
| Red Hat | Red Hat Directory Server 11.7 for RHEL 8 | — | 8080020240909040333.f969626e | Patch available | CNA |
| Red Hat | Red Hat Directory Server 11.9 for RHEL 8 | — | 8100020240902112955.37ed7c03 | Patch available | CNA |
| Red Hat | Red Hat Directory Server 12.2 EUS for RHEL 9 | — | 9020020240916150035.1674d574 | Patch available | CNA |
| Red Hat | Red Hat Directory Server 12.4 for RHEL 9 | — | 9040020240723122852.1674d574 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 7 Extended Lifecycle Support | — | 1.3.11.1-6.el7_9 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | 8100020240910065753.25e700aa | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.8 Extended Update Support | — | 8080020240807050952.6dbb3803 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | 2.4.5-9.el9_4 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9.2 Extended Update Support | — | 2.2.4-9.el9_2 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 10 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 6 | — | — | No fix listed | CNA |
- 389-ds-base Vendor— Affected — Fixed in — No fix listed CNA
- Red Hat Directory Server 11.5 E4S for RHEL 8 VendorRed Hat Affected — Fixed in 8060020250210084424.0ca98e7e Patch available CNA
- Red Hat Directory Server 11.7 for RHEL 8 VendorRed Hat Affected — Fixed in 8080020240909040333.f969626e Patch available CNA
- Red Hat Directory Server 11.9 for RHEL 8 VendorRed Hat Affected — Fixed in 8100020240902112955.37ed7c03 Patch available CNA
- Red Hat Directory Server 12.2 EUS for RHEL 9 VendorRed Hat Affected — Fixed in 9020020240916150035.1674d574 Patch available CNA
- Red Hat Directory Server 12.4 for RHEL 9 VendorRed Hat Affected — Fixed in 9040020240723122852.1674d574 Patch available CNA
- Red Hat Enterprise Linux 7 Extended Lifecycle Support VendorRed Hat Affected — Fixed in 1.3.11.1-6.el7_9 Patch available CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 8100020240910065753.25e700aa Patch available CNA
- Red Hat Enterprise Linux 8.8 Extended Update Support VendorRed Hat Affected — Fixed in 8080020240807050952.6dbb3803 Patch available CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 2.4.5-9.el9_4 Patch available CNA
- Red Hat Enterprise Linux 9.2 Extended Update Support VendorRed Hat Affected — Fixed in 2.2.4-9.el9_2 Patch available CNA
- Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 6 VendorRed Hat Affected — Fixed in — No fix listed CNA
CPE names CNA · 13
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:/a:redhat:directory_server_e4s:11.5::el8 | 11.5 | — | Red Hat |
| cpe:/a:redhat:directory_server:11.7::el8 | 11.7 | — | Red Hat |
| cpe:/a:redhat:directory_server:11.9::el8 | 11.9 | — | Red Hat |
| cpe:/a:redhat:directory_server_eus:12.2::el9 | 12.2 | — | Red Hat |
| cpe:/a:redhat:directory_server:12.4::el9 | 12.4 | — | Red Hat |
| cpe:/o:redhat:rhel_els:7 | 7 | — | Red Hat |
| cpe:/a:redhat:enterprise_linux:8::appstream | 8 | — | Red Hat |
| cpe:/a:redhat:rhel_eus:8.8::appstream | 8.8 | — | Red Hat |
| cpe:/a:redhat:enterprise_linux:9::appstream | 9 | — | Red Hat |
| cpe:/a:redhat:enterprise_linux:9::crb | 9 | — | Red Hat |
- cpe:/a:redhat:directory_server_e4s:11.5::el8 Versions 11.5 — ·Red Hat
- cpe:/a:redhat:directory_server:11.7::el8 Versions 11.7 — ·Red Hat
- cpe:/a:redhat:directory_server:11.9::el8 Versions 11.9 — ·Red Hat
- cpe:/a:redhat:directory_server_eus:12.2::el9 Versions 12.2 — ·Red Hat
- cpe:/a:redhat:directory_server:12.4::el9 Versions 12.4 — ·Red Hat
- cpe:/o:redhat:rhel_els:7 Versions 7 — ·Red Hat
- cpe:/a:redhat:enterprise_linux:8::appstream Versions 8 — ·Red Hat
- cpe:/a:redhat:rhel_eus:8.8::appstream Versions 8.8 — ·Red Hat
- cpe:/a:redhat:enterprise_linux:9::appstream Versions 9 — ·Red Hat
- cpe:/a:redhat:enterprise_linux:9::crb Versions 9 — ·Red Hat
Remediation
Red Hat 10 advisories
- RHSA-2025:1632 Released 2025-02-18 · Red Hat rating Importantredhat-ds:11 security update
- Red Hat Directory Server 11.5 E4S for RHEL 8 389-ds-base-1.4.3.34-4.module+el8dsrv+22781+5fe99dde.src::redhat-ds:11, 389-ds-base-1.4.3.34-4.module+el8dsrv+22781+5fe99dde.x86_64::redhat-ds:11, 389-ds-base-devel-1.4.3.34-4.module+el8dsrv+22781+5fe99dde.x86_64::redhat-ds:11 +5
- RHSA-2024:7458 Released 2024-10-01 · Red Hat rating Importantredhat-ds:12 security update
- Red Hat Directory Server 12.2 EUS for RHEL 9 389-ds-base-2.2.7-6.module+el9dsrv+22320+37c894f3.src::redhat-ds:12, 389-ds-base-2.2.7-6.module+el9dsrv+22320+37c894f3.x86_64::redhat-ds:12, 389-ds-base-devel-2.2.7-6.module+el9dsrv+22320+37c894f3.x86_64::redhat-ds:12 +4
- RHSA-2024:6576 Released 2024-09-11 · Red Hat rating Moderateredhat-ds:11 security and bug fix update
- Red Hat Directory Server 11.7 for RHEL 8 389-ds-base-1.4.3.34-4.module+el8dsrv+22274+a8abd89c.src::redhat-ds:11, 389-ds-base-1.4.3.34-4.module+el8dsrv+22274+a8abd89c.x86_64::redhat-ds:11, 389-ds-base-devel-1.4.3.34-4.module+el8dsrv+22274+a8abd89c.x86_64::redhat-ds:11 +5
Show 7 more Red Hat advisories
- RHSA-2024:6569 Released 2024-09-11 · Red Hat rating Moderate389-ds:1.4 security update
- Red Hat Enterprise Linux AppStream (v. 8) 389-ds-base-1.4.3.39-8.module+el8.10.0+22275+e4fc04d4.aarch64::389-ds:1.4, 389-ds-base-1.4.3.39-8.module+el8.10.0+22275+e4fc04d4.ppc64le::389-ds:1.4, 389-ds-base-1.4.3.39-8.module+el8.10.0+22275+e4fc04d4.s390x::389-ds:1.4 +19
- RHSA-2024:6568 Released 2024-09-11 · Red Hat rating Moderateredhat-ds:11 security and bug fix update
- Red Hat Directory Server 11.9 for RHEL 8 389-ds-base-1.4.3.39-5.module+el8dsrv+22259+114d7218.src::redhat-ds:11, 389-ds-base-1.4.3.39-5.module+el8dsrv+22259+114d7218.x86_64::redhat-ds:11, 389-ds-base-devel-1.4.3.39-5.module+el8dsrv+22259+114d7218.x86_64::redhat-ds:11 +5
- RHSA-2024:6153 Released 2024-09-03 · Red Hat rating Moderate389-ds-base security update
- Red Hat Enterprise Linux Server (v. 7 ELS) 389-ds-base-1.3.11.1-6.el7_9, 389-ds-base-libs-1.3.11.1-6.el7_9
- Red Hat Enterprise Linux Server Optional (v. 7 ELS) 389-ds-base-1.3.11.1-6.el7_9, 389-ds-base-devel-1.3.11.1-6.el7_9, 389-ds-base-libs-1.3.11.1-6.el7_9 +1
- RHSA-2024:5690 Released 2024-08-21 · Red Hat rating Important389-ds:1.4 security update
- Red Hat Enterprise Linux AppStream EUS (v.8.8) 389-ds-base-1.4.3.35-5.module+el8.8.0+22193+5f98570a.aarch64::389-ds:1.4, 389-ds-base-1.4.3.35-5.module+el8.8.0+22193+5f98570a.ppc64le::389-ds:1.4, 389-ds-base-1.4.3.35-5.module+el8.8.0+22193+5f98570a.s390x::389-ds:1.4 +19
- RHSA-2024:5192 Released 2024-08-12 · Red Hat rating Moderate389-ds-base security update
- Red Hat Enterprise Linux AppStream (v. 9) 389-ds-base-2.4.5-9.el9_4, 389-ds-base-libs-2.4.5-9.el9_4, python3-lib389-2.4.5-9.el9_4
- Red Hat Enterprise Linux CRB (v. 9) 389-ds-base-devel-2.4.5-9.el9_4
- RHSA-2024:4997 Released 2024-08-06 · Red Hat rating Moderateredhat-ds:12 security and bug fix update
- Red Hat Directory Server 12.4 for RHEL 9 389-ds-base-2.4.5-7.module+el9dsrv+22137+7a1133f7.src::redhat-ds:12, 389-ds-base-2.4.5-7.module+el9dsrv+22137+7a1133f7.x86_64::redhat-ds:12, 389-ds-base-devel-2.4.5-7.module+el9dsrv+22137+7a1133f7.x86_64::redhat-ds:12 +4
- RHSA-2024:4633 Released 2024-07-18 · Red Hat rating Important389-ds-base security update
- Red Hat Enterprise Linux AppStream EUS (v.9.2) 389-ds-base-2.2.4-9.el9_2, 389-ds-base-libs-2.2.4-9.el9_2, python3-lib389-2.2.4-9.el9_2
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Directory Server 11.5 E4S for RHEL 8 | Fixed | RHSA-2025:1632 |
| Red Hat Directory Server 11.7 for RHEL 8 | Fixed | RHSA-2024:6576 |
| Red Hat Directory Server 11.9 for RHEL 8 | Fixed | RHSA-2024:6568 |
| Red Hat Directory Server 12.2 EUS for RHEL 9 | Fixed | RHSA-2024:7458 |
| Red Hat Directory Server 12.4 for RHEL 9 | Fixed | RHSA-2024:4997 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2024:6569 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2024:5192 |
| Red Hat Enterprise Linux AppStream EUS (v.8.8) | Fixed | RHSA-2024:5690 |
| Red Hat Enterprise Linux AppStream EUS (v.9.2) | Fixed | RHSA-2024:4633 |
| Red Hat Enterprise Linux CRB (v. 9) | Fixed | RHSA-2024:5192 |
| Red Hat Enterprise Linux Server (v. 7 ELS) | Fixed | RHSA-2024:6153 |
| Red Hat Enterprise Linux Server Optional (v. 7 ELS) | Fixed | RHSA-2024:6153 |
Not affected: 1 product
- Red Hat Enterprise Linux 10
Timeline
- 2026-10-02 Threatist record created from CVE-2024-5953
- 2026-10-03 Alias added: GHSA-9h7v-6cr6-hcpx
References
More Red Hat vulnerabilities
- TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
- TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
- TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2024-5953 · CVE Program
- CVE-2024-5953 · NVD
- FIRST EPSS
- GHSA-9h7v-6cr6-hcpx · GitHub Advisory Database · CC BY 4.0
- CVE-2024-5953 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences