What’s Vulnerable › Vulnerabilities

CVE-2018-14638

• Severity: high (CVSS 7.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-09-14 · updated 2026-06-17
• Weakness: CWE-400

Description

A flaw was found in 389-ds-base before version 1.3.8.4-13. The process ns-slapd crashes in delete_passwdPolicy function when persistent search connections are terminated unexpectedly leading to remote denial of service.

Affected products

• Red Hat, Inc. 389-ds-base: before 1.3.8.4 — fixed in 1.3.8.4
• RedHat Enterprise Linux Aus: 7.6
• RedHat Enterprise Linux Desktop: 7.0
• RedHat Enterprise Linux Server: 7.0
• RedHat Enterprise Linux Server Eus: 7.5, 7.6
• RedHat Enterprise Linux Server Tus: 7.6
• RedHat Enterprise Linux Workstation: 7.0

How to fix

Upgrade to a fixed version: Red Hat, Inc. 389-ds-base 1.3.8.4. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHSA-2018:2757
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14638
• https://pagure.io/389-ds-base/c/78fc627accacfa4061ce48977e22301f81ea8d73
• https://access.redhat.com/errata/RHSA-2018:2757
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14638
• https://pagure.io/389-ds-base/c/78fc627accacfa4061ce48977e22301f81ea8d73

Get alerted when CVE-2018-14638 or the next vulnerability affects your stack