NULL pointer dereference in 389-ds-base - CVE-2021-3514

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU54107

NULL pointer dereference in 389-ds-base - CVE-2021-3514

Published: June 15, 2021


Vulnerability identifier: #VU54107
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-3514
CWE-ID: CWE-476
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error when using a sync_repl client in 389-ds-base. A remote authenticated user can cause a NULL pointer dereference using a specially crafted query and perform a denial of service (DoS) attack.


Affected software

389-ds-base
Red Hat Directory Server
Arch Linux
Anolis OS
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
SUSE Linux Enterprise Module for Server Applications
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
389-ds-base-tests
389-ds-base-snmp
389-ds-base-libs
389-ds-base-devel
389-ds-base
389-ds-base-legacy-tools
python3-lib389
389-ds-debuginfo
libsvrcore0-debuginfo
libsvrcore0
lib389
389-ds-devel
389-ds-debugsource
389-ds
cockpit-389-ds

How to mitigate CVE-2021-3514

Install update from vendor's website.

389-ds-base - addressed in versions 1.4.3.23, 1.4.4.16, 2.0.5
389-ds-base-tests - update to 1.3.10.2-17
389-ds-base-snmp - addressed in versions 1.3.10.2-17, 1.4.2.4-14, 1.4.3.16-16, 1.4.3.28-8.0.1
389-ds-base-libs - addressed in versions 1.3.10.2-17, 1.4.2.4-14, 1.4.3.16-16, 1.4.3.28-8.0.1
389-ds-base-devel - addressed in versions 1.3.10.2-17, 1.4.2.4-14, 1.4.3.16-16, 1.4.3.28-8.0.1
389-ds-base - addressed in versions 1.3.10.2-17, 1.4.2.4-14, 1.4.3.16-16, 1.4.3.28-8.0.1
389-ds-base-legacy-tools - addressed in versions 1.4.2.4-14, 1.4.3.16-16, 1.4.3.28-8.0.1
python3-lib389 - addressed in versions 1.4.2.4-14, 1.4.3.16-16, 1.4.3.28-8.0.1
389-ds-debuginfo - update to 1.4.3.23~git0.f53d0132b-3.15.1
libsvrcore0-debuginfo - update to 1.4.3.23~git0.f53d0132b-3.15.1
libsvrcore0 - update to 1.4.3.23~git0.f53d0132b-3.15.1
lib389 - update to 1.4.3.23~git0.f53d0132b-3.15.1
389-ds-devel - update to 1.4.3.23~git0.f53d0132b-3.15.1
389-ds-debugsource - update to 1.4.3.23~git0.f53d0132b-3.15.1
389-ds - update to 1.4.3.23~git0.f53d0132b-3.15.1
cockpit-389-ds - update to 1.4.3.28-8.0.1

External References

Related Security Bulletins