IP-DB.com
Türkçe English Deutsch Español
Log In Get API Key
5.7Medium

CVE-2024-5953389-ds-base: malformed userpassword hash may cause denial of service

389-ds-base; Red Hat Red Hat Directory Server 11.5 E4S for RHEL 8; Red Hat Red Hat Directory Server 11.7 for RHEL 8; Red Hat Red Hat Directory Server 11.9 for RHEL 8 Published: (2 years ago)

Description

A denial of service vulnerability was found in the 389-ds-base LDAP server. This issue may allow an authenticated user to cause a server denial of service while attempting to log in with a user with a malformed hash in their password.

Weakness (CWE): CWE-1288

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

VendorProductVersions
directory server 11.7 —
directory server 11.9 —
directory server 12.4 —
directory server e4s 11.5 —
directory server eus 12.2 —
enterprise linux 8 —
enterprise linux 9 —
Red Hat Red Hat Directory Server 11.5 E4S for RHEL 8 all versions
Red Hat Red Hat Directory Server 11.7 for RHEL 8 all versions
Red Hat Red Hat Directory Server 11.9 for RHEL 8 all versions
Red Hat Red Hat Directory Server 12.2 EUS for RHEL 9 all versions
Red Hat Red Hat Directory Server 12.4 for RHEL 9 all versions
Red Hat Red Hat Enterprise Linux 10 —
Red Hat Red Hat Enterprise Linux 6 —
Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support all versions
Red Hat Red Hat Enterprise Linux 8 all versions
Red Hat Red Hat Enterprise Linux 8.8 Extended Update Support all versions
Red Hat Red Hat Enterprise Linux 9 all versions
Red Hat Red Hat Enterprise Linux 9.2 Extended Update Support all versions
rhel eus 8.8 —
rhel eus 9.2 —
— 389-ds-base all versions

References and patches

Recent CVEs in the same product — Red Hat Enterprise Linux

7.3High
CVE-2026-91151

Cockpit: cockpit: local privilege escalation via insecure symlink handling in public key addition helper

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 9

A flaw was found in Cockpit. A local authenticated user with control over a target account's home directory can exploit a privileged symlink dereference vulnerability in the `ssh-add-public-key.sh` helper. When this helper runs with elevated privileges, it ca…

7.8High
CVE-2026-108472

Xfsprogs: xfsprogs: local privilege escalation via command injection in xfs_admin

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 9

A flaw was found in the xfs_admin utility in xfsprogs. The tool does not properly validate user-supplied parameters, allowing operating system command injection. A local attacker can exploit this issue by providing crafted input arguments, which may result in…

7.5High
CVE-2026-91150

Cockpit: cockpit: denial of service via unbounded fragmented websocket messages

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 9

A flaw was found in Cockpit. This vulnerability allows a remote attacker, without prior authentication, to send specially crafted fragmented WebSocket messages. These messages accumulate without a total-size limit, leading to unbounded memory exhaustion and a…