Security update for 389-ds

2024-09-1211:16:05

Google

osv.dev

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.4

Confidence

High

This update for 389-ds fixes the following issues:

Update to version 2.0.20
CVE-2024-3657: DOS via via specially crafted kerberos AS-REQ request. (bsc#1225512)
CVE-2024-5953: Malformed userPassword hashes may cause a denial of service. (bsc#1226277)
CVE-2024-2199: Malformed userPassword may cause crash at do_modify in slapd/modify.c. (bsc#1225507)
CVE-2024-1062: Fixed a heap overflow leading to denail-of-servce while writing a value larger than 256 chars in log_entry_attr. (bsc#1219836)