CVE-2024-5953

389-ds-base: malformed userpassword hash may cause denial of service

State: Published
Severity: 5.7 Medium
Published: Jun 18, 2024
Updated: Feb 25, 2026
Reserved: Jun 13, 2024

Description

A denial of service vulnerability was found in the 389-ds-base LDAP server. This issue may allow an authenticated user to cause a server denial of service while attempting to log in with a user with a malformed hash in their password.

Scores

CVSS	Score	Vector	Source
3.1	5.7 Medium	CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	redhat

Weaknesses

CWE-1288 Improper Validation of Consistency within Input

Affected Products

Product	Versions
389-ds-base
Red Hat Directory Server 11.5 E4S for RHEL 8Red Hat	8060020250210084424.0ca98e7e and laterNot affected
Red Hat Directory Server 11.7 for RHEL 8Red Hat	8080020240909040333.f969626e and laterNot affected
Red Hat Directory Server 11.9 for RHEL 8Red Hat	8100020240902112955.37ed7c03 and laterNot affected
Red Hat Directory Server 12.2 EUS for RHEL 9Red Hat	9020020240916150035.1674d574 and laterNot affected
Red Hat Directory Server 12.4 for RHEL 9Red Hat	9040020240723122852.1674d574 and laterNot affected
Red Hat Enterprise Linux 7 Extended Lifecycle SupportRed Hat	0:1.3.11.1-6.el7_9 and laterNot affected
Red Hat Enterprise Linux 8Red Hat	8100020240910065753.25e700aa and laterNot affected
Red Hat Enterprise Linux 8.8 Extended Update SupportRed Hat	8080020240807050952.6dbb3803 and laterNot affected
Red Hat Enterprise Linux 9Red Hat	0:2.4.5-9.el9_4 and laterNot affected
Red Hat Enterprise Linux 9.2 Extended Update SupportRed Hat	0:2.2.4-9.el9_2 and laterNot affected
Red Hat Enterprise Linux 10Red Hat
Red Hat Enterprise Linux 6Red Hat

References

RHSA-2024:4633vendor-advisory
RHSA-2024:4997vendor-advisory
RHSA-2024:5192vendor-advisory
RHSA-2024:5690vendor-advisory
RHSA-2024:6153vendor-advisory
RHSA-2024:6568vendor-advisory
RHSA-2024:6569vendor-advisory
RHSA-2024:6576vendor-advisory
RHSA-2024:7458vendor-advisory
RHSA-2025:1632vendor-advisory
https://access.redhat.com/security/cve/CVE-2024-5953vdb-entry
RHBZ#2292104issue-tracking
https://lists.debian.org/debian-lts-announce/2025/01/msg00015.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.