Fedoraproject 389_directory_server
39 CVEs affecting Fedoraproject 389_directory_server. Latest disclosed: 2020-01-09. Critical: 1, High: 11.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-7551 | Critical | 9.8 | 2017-08-16 | 389-ds-base version before 1.3.5.19 and 1.3.6.7 are vulnerable to password brute-force attacks during account lockout due to different return codes returned on… |
CVE-2017-15135 | High | 8.1 | 2018-01-24 | It was found that 389-ds-base since 1.3.6.1 up to and including 1.4.0.3 did not always handle internal hash comparison operations correctly during the authenti… |
CVE-2019-10171 | High | 7.5 | 2019-08-02 | It was found that the fix for CVE-2018-14648 in 389-ds-base, versions 1.4.0.x before 1.4.0.17, was incorrectly applied in RHEL 7.5. An attacker would still be… |
CVE-2019-3883 | High | 7.5 | 2019-04-17 | In 389-ds-base up to version 1.4.1.2, requests are handled by workers threads. Each sockets will be waited by the worker for at most 'ioblocktimeout' seconds… |
CVE-2018-14648 | High | 7.5 | 2018-09-28 | A flaw was found in 389 Directory Server. A specially crafted search query could lead to excessive CPU consumption in the do_search() function. An unauthentica… |
CVE-2018-14638 | High | 7.5 | 2018-09-14 | A flaw was found in 389-ds-base before version 1.3.8.4-13. The process ns-slapd crashes in delete_passwdPolicy function when persistent search connections are… |
CVE-2018-14624 | High | 7.5 | 2018-09-06 | A vulnerability was discovered in 389-ds-base through versions 1.3.7.10, 1.3.8.8 and 1.4.0.16. The lock controlling the error log was not correctly used when r… |
CVE-2018-1089 | High | 7.5 | 2018-05-09 | 389-ds-base before versions 1.4.0.9, 1.3.8.1, 1.3.6.15 did not properly handle long search filters with characters needing escapes, possibly leading to buffer… |
CVE-2018-1054 | High | 7.5 | 2018-03-07 | An out-of-bounds memory read flaw was found in the way 389-ds-base handled certain LDAP search filters, affecting all versions including 1.4.x. A remote, unaut… |
CVE-2017-15134 | High | 7.5 | 2018-03-01 | A stack buffer overflow flaw was found in the way 389-ds-base 1.3.6.x before 1.3.6.13, 1.3.7.x before 1.3.7.9, 1.4.x before 1.4.0.5 handled certain LDAP search… |
CVE-2015-1854 | High | 7.5 | 2017-09-19 | 389 Directory Server before 1.3.3.10 allows attackers to bypass intended access restrictions and modify directory entries via a crafted ldapmodrdn call. |
CVE-2016-0741 | High | 7.5 | 2016-04-19 | slapd/connection.c in 389 Directory Server (formerly Fedora Directory Server) 1.3.4.x before 1.3.4.7 allows remote attackers to cause a denial of service (infi… |
CVE-2019-14824 | Medium | 6.5 | 2019-11-08 | A flaw was found in the 'deref' plugin of 389-ds-base where it could use the 'search' permission to display attribute values. In some configurations, this coul… |
CVE-2017-2668 | Medium | 6.5 | 2018-06-22 | 389-ds-base before versions 1.3.5.17 and 1.3.6.10 is vulnerable to an invalid pointer dereference in the way LDAP bind requests are handled. A remote unauthent… |
CVE-2018-10850 | Medium | 5.9 | 2018-06-13 | 389-ds-base before versions 1.4.0.10, 1.3.8.3 is vulnerable to a race condition in the way 389-ds-base handles persistent search, resulting in a crash if the s… |
CVE-2011-0704 | Medium | 5.9 | 2018-05-04 | 389 Directory Server 1.2.7.5, when built with mozldap, allows remote attackers to cause a denial of service (replica crash) by sending an empty modify request. |
CVE-2019-10224 | Medium | 4.6 | 2019-11-25 | A flaw has been found in 389-ds-base versions 1.4.x.x before 1.4.1.3. When executed in verbose mode, the dscreate and dsconf commands may display sensitive inf… |
CVE-2018-10871 | Low | 3.8 | 2018-07-18 | 389-ds-base before versions 1.3.8.5, 1.4.0.12 is vulnerable to a Cleartext Storage of Sensitive Information. By default, when the Replica and/or retroChangeLog… |
CVE-2017-2591 | Low | 3.7 | 2018-04-30 | 389-ds-base before version 1.3.6 is vulnerable to an improperly NULL terminated array in the uniqueness_entry_to_config() function in the "attribute uniqueness… |
CVE-2010-3282 | Low | 3.3 | 2020-01-09 | 389 Directory Server before 1.2.7.1 (aka Red Hat Directory Server 8.2) and HP-UX Directory Server before B.08.10.03, when audit logging is enabled, logs the Di… |