5.7
Medium
CVE-2024-8445 389-ds-base: server crash while modifying `userpassword` using malformed input (incomplete fix for cve-2024-2199)
Description
The fix for CVE-2024-2199 in 389-ds-base was insufficient to cover all scenarios. In certain product versions, an authenticated user may cause a server crash while modifying `userPassword` using malformed input.
CVSS 3.1 detail
Vector CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitable from the adjacent network, with an ordinary account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.
- Attack vector
- Adjacent network
- Attack complexity
- Low
- Privileges required
- Low
- Interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Enterprise Linux 7 Extended Lifecycle Support | Versions not published | |
| Red Hat Directory Server 11 | Versions not published | |
| Red Hat Directory Server 12 | Versions not published | |
| Red Hat Enterprise Linux 10 | Versions not published | |
| Red Hat Enterprise Linux 6 | Versions not published | |
| Red Hat Enterprise Linux 8 | Versions not published | |
| Red Hat Enterprise Linux 9 | Versions not published |
References
- RHSA-2024:7434 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2310110 bugzilla.redhat.com
Timeline
- Published
- Last modified
Other CVEs of Red Hat Enterprise Linux 7 Extended Lifecycle Support
The 373 CVEs of Red Hat Enterprise Linux 7 Extended Lifecycle Support →
CVE-2026-114406
Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns
6.8
Medium
CVE-2026-102559
Libsoup: libsoup: heap buffer overflow during websocket client-frame masking
8.6
High
CVE-2026-102558
Libsoup: libsoup: heap buffer overflow during websocket receive-buffer growth
8.6
High
CVE-2026-102557
Libsoup: libsoup: heap buffer overflow during websocket message reassembly
8.6
High