CVE-2024-2199

389-ds-base: malformed userpassword may cause crash at do_modify in slapd/modify.c

State: Published
Severity: 5.7 Medium
Published: May 28, 2024
Updated: Jun 26, 2026
Reserved: Mar 5, 2024

Description

A denial of service vulnerability was found in 389-ds-base ldap server. This issue may allow an authenticated user to cause a server crash while modifying `userPassword` using malformed input.

Scores

CVSS	Score	Vector	Source
3.1	5.7 Medium	CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	redhat

Weaknesses

CWE-20 Improper Input Validation

Affected Products

Product	Versions
389-ds-base	before 3.1.1Affected
Red Hat Directory Server 11.5 E4S for RHEL 8Red Hat	8060020250210084424.0ca98e7e and laterNot affected
Red Hat Directory Server 11.8 for RHEL 8Red Hat	8090020240606122459.91529cd0 and laterNot affected
Red Hat Directory Server 11.9 for RHEL 8Red Hat	8100020240604161237.37ed7c03 and laterNot affected
Red Hat Directory Server 12.4 for RHEL 9Red Hat	9040020240604143706.1674d574 and laterNot affected
Red Hat Enterprise Linux 7Red Hat	0:1.3.11.1-5.el7_9 and laterNot affected
Red Hat Enterprise Linux 8Red Hat	8100020240613122040.25e700aa and laterNot affected
Red Hat Enterprise Linux 8.8 Extended Update SupportRed Hat	8080020240807050952.6dbb3803 and laterNot affected
Red Hat Enterprise Linux 9Red Hat	0:2.4.5-8.el9_4 and laterNot affected
Red Hat Enterprise Linux 9.2 Extended Update SupportRed Hat	0:2.2.4-9.el9_2 and laterNot affected
Red Hat Enterprise Linux 6Red Hat

References

RHSA-2024:3591vendor-advisory
RHSA-2024:3837vendor-advisory
RHSA-2024:4092vendor-advisory
RHSA-2024:4209vendor-advisory
RHSA-2024:4210vendor-advisory
RHSA-2024:4235vendor-advisory
RHSA-2024:4633vendor-advisory
RHSA-2024:5690vendor-advisory
RHSA-2025:1632vendor-advisory
https://access.redhat.com/security/cve/CVE-2024-2199vdb-entry
RHBZ#2267976issue-tracking
https://www.port389.org/docs/389ds/releases/release-3-1-1.html
https://lists.debian.org/debian-lts-announce/2025/01/msg00015.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.