CVE-2019-3883

In 389-ds-base up to version 1.4.1.2, requests are handled by workers threads. Each sockets will be waited by the worker for at most 'ioblocktimeout' seconds. However this timeout applies only for un-encrypted requests. Connections using SSL/TLS are not taking this timeout into account during...

CVE-2019-3883

389-ds-base up to 1.4.1.2 is affected by CVE-2019-3883: SSL/TLS reads ignore the ioblocktimeout, allowing an unauthenticated attacker to trigger hanging LDAP requests that can hang all workers and cause a DoS. Affected products include 389-ds-base deployments on various distros (Red Hat/CentOS, D...

EulerOS 2.0 SP2 : 389-ds-base (EulerOS-SA-2019-1046)

According to the version of the 389-ds-base packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - 389-ds-base: ldapsearch with server side sort allows users to cause a crash CVE-2018-10935 Note that Tenable Network Security has extracted th...

Denial Of Service (DoS)

389-ds-base is vulnerable to denial of service DoS attacks. The vulnerability exists as 389-ds-base before versions 1.4.0.10, 1.3.8.3 is vulnerable to a race condition in the way 389-ds-base handles persistent search, resulting in a crash if the server is under load. An anonymous attacker could u...

Denial Of Service (DoS)

389-ds-base is vulnerable to denial of service. A remote unauthenticated attacker is able to crash the application in a buffer overflow using a malicious LDAP request containing long search filters with unescaped characters...

Authentication Bypass

389-ds-base is vulnerable to authentication bypass attacks. The vulnerability exists as it was found that 389-ds-base since 1.3.6.1 up to and including 1.4.0.3 did not always handle internal hash comparison operations correctly during the authentication process. A remote, unauthenticated attacker...

Denial Of Service (DoS)

389-ds-base is vulnerable to denial of service. An invalid pointer dereference flaw was found in the way 389-ds-base handled LDAP bind requests. A remote unauthenticated attacker could use this flaw to make ns-slapd crash via a specially crafted LDAP bind request, resulting in denial of service...

Information Disclosure

389-ds-base is vulnerable to information disclosure attacks. The vulnerability exists as 389 Directory Server before 1.3.2.27 and 1.3.3.x before 1.3.3.9 does not properly restrict access to the "cn=changelog" LDAP sub-tree, which allows remote attackers to obtain sensitive information from the...

Information Disclosure

389-ds-base is vulnerable to information disclosure attacks. The vulnerability exists as Red Hat Directory Server 8 and 389 Directory Server, when debugging is enabled, allows remote attackers to obtain sensitive replicated metadata by searching the directory...

Privilege Escalation

389-ds-base is vulnerable to privilege escalation attacks. The vulnerability exists as the SASL authentication functionality in 389 Directory Server before 1.2.11.26 allows remote authenticated users to connect as an arbitrary user and gain privileges via the authzid parameter in a SASL/GSSAPI bi...

Information Disclosure

389-ds-base is vulnerable to information disclosure attacks. The vulnerability exists as 389 Directory Server before 1.2.11.6 aka Red Hat Directory Server before 8.2.10-3, after the password for a LDAP user has been changed and before the server has been reset, allows remote attackers to read the...

Fedora 28 : knot-resolver (2018-389bc4e911)

Knot Resolver 2.3.0 2018-04-23 ================================ Security -------- - fix CVE-2018-1110: denial of service triggered by malformed DNS messages !550, !558, security!2, security!4 - increase resilience against slow lorris attack security!5 Bugfixes -------- - validation: fix SERVFAIL ...

UBUNTU-CVE-2018-14719

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization...

DEBIAN-CVE-2018-14719

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization...

EulerOS 2.0 SP2 : 389-ds-base (EulerOS-SA-2018-1439)

According to the version of the 389-ds-base packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - 389-ds-base: Mishandled search requests in servers/slapd/search.c:dosearch allows for denial of service CVE-2018-14648 Note that Tenable Netwo...

EulerOS 2.0 SP3 : 389-ds-base (EulerOS-SA-2018-1440)

According to the version of the 389-ds-base packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - 389-ds-base: Mishandled search requests in servers/slapd/search.c:dosearch allows for denial of service CVE-2018-14648 Note that Tenable Netwo...

DSShop open source single store mall system front-end command execution vulnerability

DSShop is based on ThinkPHP5 framework for the development of a single store mall system, full support for PC, WAP, microblogging and other terminal equipment, designed for business users to adapt to the entire business model of the solution, can fully meet the operational needs. DSShop open sour...

Amazon Linux AMI : 389-ds-base (ALAS-2018-1106)

It was found that a specially crafted search query could lead to excessive CPU consumption in the dosearch function. An unauthenticated attacker could use this flaw to provoke a denial of service.CVE-2018-14648 C Tenable Network Security, Inc. The descriptive text and package checks in this plugi...

Medium: 389-ds-base

Issue Overview: It was found that a specially crafted search query could lead to excessive CPU consumption in the dosearch function. An unauthenticated attacker could use this flaw to provoke a denial of service.CVE-2018-14648 Affected Packages: 389-ds-base Issue Correction: Run yum update...

Scientific Linux Security Update : 389-ds-base on SL7.x x86_64 (20181030)

Security Fixes : - 389-ds-base: Mishandled search requests in servers/slapd/search.c:dosearch allows for denial of service CVE-2018-14648 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid119176; scriptversion"1.6";...