Denial Of Service (DoS)

2022-03-1300:42:56

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

JSON

389-ds-base is vulnerable to denial of service. The vulnerability exists due to a double-free found in the way 389-ds-base handles virtual attributes context in persistent searches allowing an attacker to crash the system by sending a series of search requests.

CPENameOperatorVersion
389-ds-baseeq2.0.6__1.module_el8+12264+8a44fa21
389-ds-baseeq1.3.3.1__23.ael7b_1
389-ds-baseeq1.4.3.16__8.module_el8.4.0+644+ed25d39e
389-ds-baseeq1.4.2.8__3.module_el8+8189+bf1c0954
389-ds-baseeq1.4.3.16__4.module_el8.4.0+578+f55145db
389-ds-baseeq2.0.10__2.module_el8+13300+9280cf64
389-ds-baseeq1.3.10.2__13.el7_9
389-ds-baseeq1.4.3.17__1.module_el8+10764+2b5f8656
389-ds-baseeq2.0.10__1.module_el8+13164+4051bcbe
389-ds-baseeq1.4.3.2__1.module_el8+7439+6ecde4c0.1

Name	Operator	Version
389-ds-base	eq	2.0.6__1.module_el8+12264+8a44fa21
389-ds-base	eq	1.3.3.1__23.ael7b_1
389-ds-base	eq	1.4.3.16__8.module_el8.4.0+644+ed25d39e
389-ds-base	eq	1.4.2.8__3.module_el8+8189+bf1c0954
389-ds-base	eq	1.4.3.16__4.module_el8.4.0+578+f55145db
389-ds-base	eq	2.0.10__2.module_el8+13300+9280cf64
389-ds-base	eq	1.3.10.2__13.el7_9
389-ds-base	eq	1.4.3.17__1.module_el8+10764+2b5f8656
389-ds-base	eq	2.0.10__1.module_el8+13164+4051bcbe
389-ds-base	eq	1.4.3.2__1.module_el8+7439+6ecde4c0.1