CVE-2024-3657

389-ds-base: potential denial of service via specially crafted kerberos as-req request

CVSS 7.5 HIGHEPSS 1.3%CWE-20

Vexday Risk Score

21Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 7.5EPSS 1.3%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Lifecycle

28 May 2024Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

A flaw was found in 389-ds-base. A specially-crafted LDAP query can potentially cause a failure on the directory server, leading to a denial of service

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Red Hat · Red Hat Directory Server 11.5 E4S for RHEL 8 Red Hat · Red Hat Directory Server 11.7 for RHEL 8 Red Hat · Red Hat Directory Server 11.8 for RHEL 8 Red Hat · Red Hat Directory Server 11.9 for RHEL 8 Red Hat · Red Hat Directory Server 12.2 EUS for RHEL 9 Red Hat · Red Hat Directory Server 12.4 for RHEL 9 Red Hat · Red Hat Enterprise Linux 10 Red Hat · Red Hat Enterprise Linux 6 Red Hat · Red Hat Enterprise Linux 7 Red Hat · Red Hat Enterprise Linux 8 Red Hat · Red Hat Enterprise Linux 8.8 Extended Update Support Red Hat · Red Hat Enterprise Linux 9 Red Hat · Red Hat Enterprise Linux 9.2 Extended Update Support

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References