Security update for 389-ds

2024-09-1612:39:40

Google

osv.dev

389-ds

security update

cve-2024-3657

cve-2024-5953

cve-2024-2199

dos

userpassword

kerberos

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

6.7

Confidence

High

This update for 389-ds fixes the following issues:

Update to version 1.4.4.20~git3.e7ac6d87:
CVE-2024-3657: DOS via via specially crafted kerberos AS-REQ request. (bsc#1225512)
CVE-2024-5953: Malformed userPassword hashes may cause a denial of service. (bsc#1226277)
CVE-2024-2199: Malformed userPassword may cause crash at do_modify in slapd/modify.c. (bsc#1225507)