Improper input validation in 389-ds-base - CVE-2018-10935

Vulnerability identifier: #VU15529

CSH Severity: Low

CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-10935

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote authenticated attacker to cause DoS condition on the target system.

The vulnerability exists due to improper processing of Lightweight Directory Access Protocol (LDAP) queries. A remote attacker can send execute the ldapsearch command with server-side sorting controls and cause the LDAP server to crash, resulting in a DoS condition.

389-ds-base
Amazon Linux AMI
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux for Power
Opensuse

The vulnerability has been addressed in the versions 1.3.8.7 and 1.4.0.14.

389-ds-base - addressed in versions 1.3.8.7, 1.4.0.14

• https://pagure.io/389-ds-base/issue/49890

• Denial of service in 389-ds-base
• Amazon Linux AMI update for 389-ds-base
• OpenSUSE Linux update for 389-ds
• Red Hat update for 389-ds-base
• Red Hat update for 389-ds-base