A flaw was found in 389-ds-base. A specially-crafted LDAP query can potentially cause a failure on the directory server, leading to a denial of service

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-48c0a7fa73 advisory.

    Automatic update for 389-ds-base-3.1.1-1.fc41.

    ##### **Changelog**

    ```
    * Tue Jul 30 2024 Viktor Ashirov <vashirov@redhat.com> - 3.1.1-1
    - Update to 3.1.1
    - Resolves: CVE-2024-1062 (rhbz#2261884)
    - Resolves: CVE-2024-2199 (rhbz#2283632)
    - Resolves: CVE-2024-3657 (rhbz#2283631)
    - Resolves: CVE-2024-5953 (rhbz#2292109)

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:5690 advisory.

    389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the     Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

    Security Fix(es):

    * 389-ds-base: a heap overflow leading to denail-of-servce while writing a value larger than 256 chars (in     log_entry_attr) (CVE-2024-1062)

    * 389-ds-base: Malformed userPassword may cause crash at do_modify in slapd/modify.c (CVE-2024-2199)

    * 389-ds-base: potential denial of service via specially crafted kerberos AS-REQ request (CVE-2024-3657)

    * 389-ds-base: Malformed userPassword hash may cause Denial of Service (CVE-2024-5953)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:7458 advisory.

    Red Hat Directory Server is an LDAPv3-compliant directory server. The suite of packages includes the     Lightweight Directory Access Protocol (LDAP) server, as well as command-line utilities and Web UI packages     for server administration.

    Security Fix(es):

    * 389-ds-base: Denial of service when writing a value larger than 256 chars in     log_entry_attr (CVE-2024-1062) (BZ#2261879)

    * 389-ds-base: Potential denial of service via specially crafted kerberos AS-REQ request (CVE-2024-3657)     (BZ#2274401)

    * 389-ds-base: Malformed userPassword hash may cause Denial of Service (CVE-2024-5953) (BZ#2292104)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:6576 advisory.

    Red Hat Directory Server is an LDAPv3-compliant directory server. The suite of packages includes the     Lightweight Directory Access Protocol (LDAP) server, as well as command-line utilities and Web UI packages     for server administration.

    Security Fixes:

    * 389-ds-base: Malformed userPassword hash may cause Denial of Service (CVE-2024-5953)

    * 389-ds-base: Specially crafted kerberos AS-REQ request may cause Denial of Service (CVE-2024-3657)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Improved performance of filter component when evaluating a large value     set, such as group members  (DIRSRV-153)

    * The new connection timeout error no longer breaks error mapping (DIRSRV-154)

    Users of Red Hat Directory Server 11 are advised to install these updated packages.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3844-1 advisory.

    - Persist extracted key path for ldap_ssl_client_init over repeat invocations (bsc#1230852)
    - Re-enable use of .dsrc basedn for dsidm commands (bsc#1231462)
    - Update to version 2.2.10~git18.20ce9289:
      * RFE: Use previously extracted key path
      * Update dsidm to prioritize basedn from .dsrc over interactive input
      * UI: Instance fails to load when DB backup directory doesn't exist
      * Improve online import robustness when the server is under load
      * Ensure all slapi_log_err calls end format strings with newline character \n
      * RFE: when memberof is enabled, defer updates of members from the update of the group
      * Provide more information in the error message during setup_ol_tls_conn()
      * Wrong set of entries returned for some search filters
      * Schema lib389 object is not keeping custom schema data upon editing
      * UI: Fix audit issue with npm - micromatch
      * Fix long delay when setting replication agreement with dsconf
      * Changelog trims updates from a given RID even if a consumer has not received any of them
      * test_password_modify_non_utf8 should set default password storage scheme
      * Update Cargo.lock
      * Rearrange includes for 32-bit support logic
      * Fix fedora cop RawHide builds
      * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
      * Enabling replication for a sub suffix crashes browser
      * d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes
      * Slow ldif2db import on a newly created BDB backend
      * Audit log buffering doesn't handle large updates
      * RFE: improve the performance of evaluation of filter component when tested against a large valueset     (like group members)
      * passwordHistory is not updated with a pre-hashed password
      * ns-slapd crash in referint_get_config
      * Fix the UTC offset print
      * Fix OpenLDAP version autodetection
      * RFE: add new operation note for MFA authentications
      * Add log buffering to audit log
      * Fix connection timeout error breaking errormap
      * Improve dsidm CLI No Such Entry handling
      * Improve connection timeout error logging
      * Add hidden -v and -j options to each CLI subcommand
      * Fix various issues with logconv.pl
      * Fix certificate lifetime displayed as NaN
      * Enhance Rust and JS bundling and add SPDX licenses for both
      * Remove audit-ci from dependencies
      * Fix unused variable warning from previous commit
      * covscan: fix memory leak in audit log when adding entries
      * Add a check for tagged commits
      * dscreate ds-root - accepts relative path
      * Change replica_id from str to int
      * Attribute Names changed to lowercase after adding the Attributes
      * ns-slapd crashes at startup if a backend has no suffix
      * During an update, if the target entry is reverted in the entry cache, the server should not retry to     lock it
      * Reversion of the entry cache should be limited to BETXN plugin failures
      * Disable Transparent Huge Pages
      * Freelist ordering causes high wtime
      * Security fix for CVE-2024-2199
    - VUL-0: CVE-2024-3657: 389-ds: potential denial of service via specially crafted kerberos AS-REQ request     (bsc#1225512)
    - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword hashes may cause a denial of service (bsc#1226277)
    - 389ds crash when user does change password using iso-8859-1 encoding (bsc#1228912)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3843-1 advisory.

    - Persist extracted key path for ldap_ssl_client_init over repeat invocations (bsc#1230852)
    - Re-enable use of .dsrc basedn for dsidm commands (bsc#1231462)
    - Update to version 2.2.10~git18.20ce9289:
      * RFE: Use previously extracted key path
      * Update dsidm to prioritize basedn from .dsrc over interactive input
      * UI: Instance fails to load when DB backup directory doesn't exist
      * Improve online import robustness when the server is under load
      * Ensure all slapi_log_err calls end format strings with newline character \n
      * RFE: when memberof is enabled, defer updates of members from the update of the group
      * Provide more information in the error message during setup_ol_tls_conn()
      * Wrong set of entries returned for some search filters
      * Schema lib389 object is not keeping custom schema data upon editing
      * UI: Fix audit issue with npm - micromatch
      * Fix long delay when setting replication agreement with dsconf
      * Changelog trims updates from a given RID even if a consumer has not received any of them
      * test_password_modify_non_utf8 should set default password storage scheme
      * Update Cargo.lock
      * Rearrange includes for 32-bit support logic
      * Fix fedora cop RawHide builds
      * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
      * Enabling replication for a sub suffix crashes browser
      * d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes
      * Slow ldif2db import on a newly created BDB backend
      * Audit log buffering doesn't handle large updates
      * RFE: improve the performance of evaluation of filter component when tested against a large valueset     (like group members)
      * passwordHistory is not updated with a pre-hashed password
      * ns-slapd crash in referint_get_config
      * Fix the UTC offset print
      * Fix OpenLDAP version autodetection
      * RFE: add new operation note for MFA authentications
      * Add log buffering to audit log
      * Fix connection timeout error breaking errormap
      * Improve dsidm CLI No Such Entry handling
      * Improve connection timeout error logging
      * Add hidden -v and -j options to each CLI subcommand
      * Fix various issues with logconv.pl
      * Fix certificate lifetime displayed as NaN
      * Enhance Rust and JS bundling and add SPDX licenses for both
      * Remove audit-ci from dependencies
      * Fix unused variable warning from previous commit
      * covscan: fix memory leak in audit log when adding entries
      * Add a check for tagged commits
      * dscreate ds-root - accepts relative path
      * Change replica_id from str to int
      * Attribute Names changed to lowercase after adding the Attributes
      * ns-slapd crashes at startup if a backend has no suffix
      * During an update, if the target entry is reverted in the entry cache, the server should not retry to     lock it
      * Reversion of the entry cache should be limited to BETXN plugin failures
      * Disable Transparent Huge Pages
      * Freelist ordering causes high wtime
      * Security fix for CVE-2024-2199
    - VUL-0: CVE-2024-3657: 389-ds: potential denial of service via specially crafted kerberos AS-REQ request     (bsc#1225512)
    - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword hashes may cause a denial of service (bsc#1226277)
    - 389ds crash when user does change password using iso-8859-1 encoding (bsc#1228912)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3257-1 advisory.

    - Update to version 1.4.4.20~git3.e7ac6d87:
    - CVE-2024-3657: DOS via via specially crafted kerberos AS-REQ request. (bsc#1225512)
    - CVE-2024-5953: Malformed userPassword hashes may cause a denial of service. (bsc#1226277)
    - CVE-2024-2199: Malformed userPassword may cause crash at do_modify in slapd/modify.c. (bsc#1225507)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3218-1 advisory.

    - Update to version 2.0.20
    - CVE-2024-3657: DOS via via specially crafted kerberos AS-REQ request. (bsc#1225512)
    - CVE-2024-5953: Malformed userPassword hashes may cause a denial of service. (bsc#1226277)
    - CVE-2024-2199: Malformed userPassword may cause crash at do_modify in slapd/modify.c. (bsc#1225507)
    - CVE-2024-1062: Fixed a heap overflow leading to denail-of-servce while writing a value larger than 256     chars in log_entry_attr. (bsc#1219836)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3082-1 advisory.

    Security issues fixed:

    - CVE-2024-3657: Fixed potential denial of service via specially crafted kerberos AS-REQ request     (bsc#1225512)
    - CVE-2024-5953: Fixed a denial of service caused by malformed userPassword hashes (bsc#1226277)
    - CVE-2024-2199: Fixed a crash caused by malformed userPassword in do_modify() (bsc#1225507)

    Non-security issues fixed:

    - crash when user does change password using iso-8859-1 encoding (bsc#1228912)

    - Update to version 2.2.10~git2.345056d3:
      * Issue 2324 - Add a CI test (#6289)
      * Issue 6284 - BUG - freelist ordering causes high wtime

    - Update to version 2.2.10~git0.4d7218b7:
      * Bump version to 2.2.10
      * Issue 5327 - Fix test metadata
      * Issue 5853 - Update Cargo.lock
      * Issue 5962 - Rearrange includes for 32-bit support logic
      * Issue 5973 - Fix fedora cop RawHide builds (#5974)
      * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
      * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
      * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
      * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
      * Issue 6170 - audit log buffering doesn't handle large updates
      * Issue 6193 - Test failure: test_tls_command_returns_error_text
      * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory:
    '/var/cache/dnf/metadata_lock.pid'`
      * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a     large valueset (like group members) (#6173)
      * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
      * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
      * Issue 6117 - Fix the UTC offset print (#6118)
      * Issue 5305 - OpenLDAP version autodetection doesn't work
      * Issue 6112 - RFE - add new operation note for MFA authentications
      * Issue 5842 - Add log buffering to audit log
      * Issue 6103 - New connection timeout error breaks errormap (#6104)
      * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
      * Issue 6096 - Improve connection timeout error logging (#6097)
      * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
      * Issue 5487 - Fix various isses with logconv.pl (#6085)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-c8290315df advisory.

    ##### **Changelog**

    ```
    * Tue Jul 30 2024 Viktor Ashirov <vashirov@redhat.com> - 2.4.6-1
    - Update to 2.4.6
    - Resolves: CVE-2024-1062 (rhbz#2261884)
    - Resolves: CVE-2024-2199 (rhbz#2283632)
    - Resolves: CVE-2024-3657 (rhbz#2283631)
    - Resolves: CVE-2024-5953 (rhbz#2292109)     ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2910-1 advisory.

    Security issues fixed:

    - CVE-2024-3657: Fixed potential denial of service via specially crafted kerberos AS-REQ request     (bsc#1225512)
    - CVE-2024-5953: Fixed a denial of service caused by malformed userPassword hashes (bsc#1226277)
    - CVE-2024-2199: Fixed a crash caused by malformed userPassword in do_modify() (bsc#1225507)

    Non-security issues fixed:

    - crash when user does change password using iso-8859-1 encoding (bsc#1228912)

    - Update to version 2.2.10:

      Issue 2324 - Add a CI test (#6289)       Issue 6284 - BUG - freelist ordering causes high wtime       Issue 5327 - Fix test metadata       Issue 5853 - Update Cargo.lock       Issue 5962 - Rearrange includes for 32-bit support logic       Issue 5973 - Fix fedora cop RawHide builds (#5974)       Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console       Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)       Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)       Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)       Issue 6170 - audit log buffering doesn't handle large updates       Issue 6193 - Test failure: test_tls_command_returns_error_text       Issue 6189 - CI tests fail with `[Errno 2] No such file or directory:
    '/var/cache/dnf/metadata_lock.pid'`       Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large     valueset (like group members) (#6173)       Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)       Issue 6080 - ns-slapd crash in referint_get_config (#6081)       Issue 6117 - Fix the UTC offset print (#6118)       Issue 5305 - OpenLDAP version autodetection doesn't work       Issue 6112 - RFE - add new operation note for MFA authentications       Issue 5842 - Add log buffering to audit log       Issue 6103 - New connection timeout error breaks errormap (#6104)       Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)       Issue 6096 - Improve connection timeout error logging (#6097)       Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)       Issue 5487 - Fix various isses with logconv.pl (#6085)       Issue 6052 - Paged results test sets hostname to `localhost` on test collection       Issue 6061 - Certificate lifetime displayed as NaN       Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)       Issue 3555 - Remove audit-ci from dependencies (#6056)       Issue 5647 - Fix unused variable warning from previous commit (#5670)       issue 5647 - covscan: memory leak in audit log when adding entries (#5650)       Issue 6047 - Add a check for tagged commits       Issue 6041 - dscreate ds-root - accepts relative path (#6042)       Issue 6034 - Change replica_id from str to int       Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)       Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)       Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not     retry to lock it (#6007)       Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)       Issue 5954 - Disable Transparent Huge Pages

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-ac07913be8 advisory.

    ##### **Changelog**

    ```
    * Tue Jul 30 2024 Viktor Ashirov <vashirov@redhat.com> - 3.0.4-2
    - Replace lmdb with lmdb-libs in Requires

    * Tue Jul 30 2024 Viktor Ashirov <vashirov@redhat.com> - 3.0.4-1
    - Update to 3.0.4
    - Resolves: CVE-2024-1062 (rhbz#2261884)
    - Resolves: CVE-2024-2199 (rhbz#2283632)
    - Resolves: CVE-2024-3657 (rhbz#2283631)
    - Resolves: CVE-2024-5953 (rhbz#2292109)     ```




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:4633 advisory.

    389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the     Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

    Security Fix(es):

    * 389-ds-base: a heap overflow leading to denail-of-servce while writing a value larger than 256 chars (in     log_entry_attr) (CVE-2024-1062)

    * 389-ds-base: Malformed userPassword may cause crash at do_modify in slapd/modify.c (CVE-2024-2199)

    * 389-ds-base: potential denial of service via specially crafted kerberos AS-REQ request (CVE-2024-3657)

    * 389-ds-base: Malformed userPassword hash may cause Denial of Service (CVE-2024-5953)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:4235 advisory.

    * 389-ds-base: potential denial of service via specially crafted kerberos AS-REQ request (CVE-2024-3657)

    * 389-ds-base: Malformed userPassword may cause crash at do_modify in slapd/modify.c (CVE-2024-2199)

Tenable has extracted the preceding description block directly from the Rocky Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:4235 advisory.

    * 389-ds-base: potential denial of service via specially crafted kerberos AS-REQ request (CVE-2024-3657)
    * 389-ds-base: Malformed userPassword may cause crash at do_modify in slapd/modify.c (CVE-2024-2199)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-4235 advisory.

    [1.4.3.39-7]
    - Bump version to 1.4.3.39-7
    - Resolves: RHEL-16277 - LDAP connections are closed with code T2 before the IO block timeout is reached.
    [rhel-8.10.0.z]

    [1.4.3.39-6]
    - Bump version to 1.4.3.39-6
    - Resolves: RHEL-16277 - LDAP connections are closed with code T2 before the IO block timeout is reached.
    [rhel-8.10.0.z]

    [1.4.3.39-5]
    - Bump version to 1.4.3.39-5
    - Resolves: RHEL-16277 - LDAP connections are closed with code T2 before the IO block timeout is reached.
    [rhel-8.10.0.z]

    [1.4.3.39-4]
    - Bump version to 1.4.3.39-4
    - Resolves: RHEL-34818 - redhat-ds:11/389-ds-base: Malformed userPassword may cause crash at do_modify in     slapd/modify.c
    - Resolves: RHEL-34824 - redhat-ds:11/389-ds-base: potential denial of service via specially crafted     kerberos AS-REQ request

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:4235 advisory.

    389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the     Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

    Security Fix(es):

    * 389-ds-base: potential denial of service via specially crafted kerberos AS-REQ request (CVE-2024-3657)

    * 389-ds-base: Malformed userPassword may cause crash at do_modify in slapd/modify.c (CVE-2024-2199)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:4210 advisory.

    Red Hat Directory Server is an LDAPv3-compliant directory server. The suite of packages includes the     Lightweight Directory Access Protocol (LDAP) server, as well as command-line utilities and Web UI packages     for server administration.

    Security Fix(es):

    * ns-slapd crashing in ldap_mods_free() (CVE-2024-2199) (BZ#2267976)

    * Potential denial of service via specially crafted kerberos     AS-REQ request (CVE-2024-3657) (BZ#2274401)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:4209 advisory.

    Red Hat Directory Server is an LDAPv3-compliant directory server. The suite of packages includes the     Lightweight Directory Access Protocol (LDAP) server, as well as command-line utilities and Web UI packages     for server administration.

    Security Fix(s):
    * 389-ds-base: Potential denial of service via specially crafted kerberos AS-REQ request (CVE-2024-3657)     (BZ#2274401)

    * 389-ds-base: Authenticated user can cause a server failure while modifying `userPassword` using     malformed input (CVE-2024-2199) (BZ#2267976)

    * 389-ds-base: Denial of service when writing a value larger than 256 chars in log_entry_attr     (CVE-2024-1062) (BZ#2261879)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug fix(es):

    * Directory Server now flushes the entry cache less frequently (BZ#2268177)

    * The `ns-slapd` binary is now linked with the thread-safe `libldap_r` library, no longer causing     segmentation fault (BZ#2264534)

    Users of Red Hat Directory Server 11 are advised to install these updated packages.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:4092 advisory.

    Red Hat Directory Server is an LDAPv3-compliant directory server. The suite of packages includes the     Lightweight Directory Access Protocol (LDAP) server, as well as command-line utilities and Web UI packages     for server administration.

    Security Fix(es):

    * 389-ds-base: potential denial of service via specially crafted kerberos AS-REQ request (CVE-2024-3657)     (2267976)

    * 389-ds-base: Malformed userPassword may cause crash at do_modify in slapd/modify.c (CVE-2024-2199)     (2274401)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * One level scoped search now returns a subsuffix correctly (BZ#2292903)

    * Improved performance of filter component evaluation when tested against a large value set, such as group     members (BZ#2293001)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:3837 advisory.

    * 389-ds-base: potential denial of service via specially crafted kerberos AS-REQ request (CVE-2024-3657)

    * 389-ds-base: Malformed userPassword may cause crash at do_modify in slapd/modify.c (CVE-2024-2199)

Tenable has extracted the preceding description block directly from the Rocky Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:3837 advisory.

    * 389-ds-base: potential denial of service via specially crafted kerberos AS-REQ request (CVE-2024-3657)
    * 389-ds-base: Malformed userPassword may cause crash at do_modify in slapd/modify.c (CVE-2024-2199)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:3591 advisory.

  - A denial of service vulnerability was found in 389-ds-base ldap server. This issue may allow an     authenticated user to cause a server crash while modifying `userPassword` using malformed input.
    (CVE-2024-2199)

  - A flaw was found in 389-ds-base. A specially-crafted LDAP query can potentially cause a failure on the     directory server, leading to a denial of service (CVE-2024-3657)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-3837 advisory.

    [2.4.5-8]
    - Bump version to 2.4.5-8
    - Fix License tag

    [2.4.5-7]
    - Bump version to 2.4.5-7
    - Resolves: RHEL-34819 - redhat-ds:11/389-ds-base: Malformed userPassword may cause crash at do_modify in     slapd/modify.c
    - Resolves: RHEL-34825 - redhat-ds:11/389-ds-base: potential denial of service via specially crafted     kerberos AS-REQ requ

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:3837 advisory.

    389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base     packages include the Lightweight Directory Access Protocol (LDAP) server and     command-line utilities for server administration.

    Security Fix(es):

    * 389-ds-base: potential denial of service via specially crafted kerberos AS-REQ request (CVE-2024-3657)

    * 389-ds-base: Malformed userPassword may cause crash at do_modify in slapd/modify.c (CVE-2024-2199)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References     section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-3591 advisory.

    [1.3.11.1-5]
    - Bump version to 1.3.11.1-5
    - Resolves: RHEL-33337 - redhat-ds:11/389-ds-base: potential denial of service via specially crafted     kerberos AS-REQ request
    - Resolves: RHEL-34817 - redhat-ds:11/389-ds-base: Malformed userPassword may cause crash at do_modify in     slapd/modify.c

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:3591 advisory.

    389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the     Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

    Security Fix(es):

    * 389-ds-base: potential denial of service via specially crafted kerberos AS-REQ request (CVE-2024-3657)

    * 389-ds-base: Malformed userPassword may cause crash at do_modify in slapd/modify.c (CVE-2024-2199)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
211108	Fedora 41 : 389-ds-base (2024-48c0a7fa73)	Nessus	Fedora Local Security Checks	high
210573	RHEL 8 : 389-ds:1.4 (RHSA-2024:5690)	Nessus	Red Hat Local Security Checks	high
210572	RHEL 9 : redhat-ds:12 (RHSA-2024:7458)	Nessus	Red Hat Local Security Checks	high
210517	RHEL 8 : redhat-ds:11 (RHSA-2024:6576)	Nessus	Red Hat Local Security Checks	high
210037	SUSE SLES15 / openSUSE 15 Security Update : 389-ds (SUSE-SU-2024:3844-1)	Nessus	SuSE Local Security Checks	high
210036	SUSE SLES15 / openSUSE 15 Security Update : 389-ds (SUSE-SU-2024:3843-1)	Nessus	SuSE Local Security Checks	high
207330	SUSE SLES15 Security Update : 389-ds (SUSE-SU-2024:3257-1)	Nessus	SuSE Local Security Checks	high
207209	SUSE SLES15 Security Update : 389-ds (SUSE-SU-2024:3218-1)	Nessus	SuSE Local Security Checks	high
206434	SUSE SLES15 / openSUSE 15 Security Update : 389-ds (SUSE-SU-2024:3082-1)	Nessus	SuSE Local Security Checks	high
205627	Fedora 39 : 389-ds-base (2024-c8290315df)	Nessus	Fedora Local Security Checks	high
205578	SUSE SLES15 Security Update : 389-ds (SUSE-SU-2024:2910-1)	Nessus	SuSE Local Security Checks	high
205571	Fedora 40 : 389-ds-base (2024-ac07913be8)	Nessus	Fedora Local Security Checks	high
202608	RHEL 9 : 389-ds-base (RHSA-2024:4633)	Nessus	Red Hat Local Security Checks	high
202380	Rocky Linux 8 : 389-ds (RLSA-2024:4235)	Nessus	Rocky Linux Local Security Checks	high
201886	AlmaLinux 8 : 389-ds (ALSA-2024:4235)	Nessus	Alma Linux Local Security Checks	high
201853	Oracle Linux 8 : 389-ds (ELSA-2024-4235)	Nessus	Oracle Linux Local Security Checks	high
201285	RHEL 8 : 389-ds (RHSA-2024:4235)	Nessus	Red Hat Local Security Checks	high
201231	RHEL 8 : redhat-ds:11 (RHSA-2024:4210)	Nessus	Red Hat Local Security Checks	high
201230	RHEL 8 : redhat-ds:11 (RHSA-2024:4209)	Nessus	Red Hat Local Security Checks	high
200994	RHEL 9 : redhat-ds:12 (RHSA-2024:4092)	Nessus	Red Hat Local Security Checks	high
200592	Rocky Linux 9 : 389-ds-base (RLSA-2024:3837)	Nessus	Rocky Linux Local Security Checks	high
200550	AlmaLinux 9 : 389-ds-base (ALSA-2024:3837)	Nessus	Alma Linux Local Security Checks	high
200499	CentOS 7 : 389-ds-base (RHSA-2024:3591)	Nessus	CentOS Local Security Checks	high
200441	Oracle Linux 9 : 389-ds-base (ELSA-2024-3837)	Nessus	Oracle Linux Local Security Checks	high
200432	RHEL 9 : 389-ds-base (RHSA-2024:3837)	Nessus	Red Hat Local Security Checks	high
200101	Oracle Linux 7 : 389-ds-base (ELSA-2024-3591)	Nessus	Oracle Linux Local Security Checks	high
200097	RHEL 7 : 389-ds-base (RHSA-2024:3591)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2024-3657

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high