CVE-2024-6237: falha de média gravidade em 389-ds-base
389-ds-base: unauthenticated user can trigger a dos by sending a specific extended search request
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.5epss 0.9%
A flaw was found in the 389 Directory Server. This flaw allows an unauthenticated user to cause a systematic server crash while sending a specific extended search request, leading to a denial of service.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
389-ds-baseRed Hat · Red Hat Directory Server 11Red Hat · Red Hat Directory Server 12.4 for RHEL 9Red Hat · Red Hat Enterprise Linux 10Red Hat · Red Hat Enterprise Linux 6Red Hat · Red Hat Enterprise Linux 7Red Hat · Red Hat Enterprise Linux 8Red Hat · Red Hat Enterprise Linux 9CVEs relacionadas — 389-ds-base
No mesmo produto, das mais perigosas para as menos.
CVE-2024-3657HIGH389-ds-base: potential denial of service via specially crafted kerberos as-req requestEPSS 1.3%CVE-2026-9064HIGH389-ds-base: 389-ds-base: unbounded ldap controls count in get_ldapmessage_controls_ext() causes cpu and heap amplification (remote dos)EPSS 0.8%CVE-2026-78701MEDIUM389-ds-base: 389-ds-base: cve-2026-11610 incomplete fix may introduce a connection-stall dosEPSS 0.8%CVE-2025-2487MEDIUM389-ds-base: null pointer dereference leads to denial of serviceEPSS 0.6%CVE-2024-5953MEDIUM389-ds-base: malformed userpassword hash may cause denial of serviceEPSS 0.6%CVE-2024-2199MEDIUM389-ds-base: malformed userpassword may cause crash at do_modify in slapd/modify.cEPSS 0.6%