CVE-2022-2850

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-10-14 · updated 2026-06-17
Weakness: CWE-476

Description

A flaw was found In 389-ds-base. When the Content Synchronization plugin is enabled, an authenticated user can reach a NULL pointer dereference using a specially crafted query. This flaw allows an authenticated attacker to cause a denial of service. This CVE is assigned against an incomplete fix of CVE-2021-3514.

Affected products

Debian Linux: 10.0
Fedoraproject Fedora: 35, 36
Port389 389-Ds-Base: from 2.0.0 through 2.4.1
RedHat Directory Server: 11.0, 12.0
Red Hat Enterprise Linux: 6.0, 7.0, 8.0, 9.0

References

https://access.redhat.com/security/cve/CVE-2022-2850
https://bugzilla.redhat.com/show_bug.cgi?id=2118691
https://lists.debian.org/debian-lts-announce/2023/04/msg00026.html
https://access.redhat.com/security/cve/CVE-2022-2850
https://bugzilla.redhat.com/show_bug.cgi?id=2118691
https://lists.debian.org/debian-lts-announce/2023/04/msg00026.html
https://lists.debian.org/debian-lts-announce/2025/01/msg00015.html

Get alerted when CVE-2022-2850 or the next vulnerability affects your stack