What’s Vulnerable › Vulnerabilities

CVE-2024-1062: 389-ds-base: a heap overflow leading to denail-of-servce while writing a value larger than 256 chars (in log_entry_attr)

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-02-12 · updated 2026-06-17
Weakness: CWE-122

Description

A heap overflow flaw was found in 389-ds-base. This issue leads to a denial of service when writing a value larger than 256 chars in log_entry_attr.

Affected products

Fedoraproject Fedora: 39, 40, 41
Red Hat 389 Directory Server: before 2.2.0 — fixed in 2.2.0
RedHat Directory Server: 11.7, 11.8, 12.0
Red Hat Enterprise Linux: 8.0
RedHat Enterprise Linux Eus: 8.6, 8.8, 9.2
RedHat Enterprise Linux For Arm 64 Eus: 8.6, 8.8, 9.2
RedHat Enterprise Linux For Ibm Z Systems: 9.2
RedHat Enterprise Linux For Ibm Z Systems Eus: 8.8
RedHat Enterprise Linux For Power Little Endian Eus: 8.8, 9.2
RedHat Enterprise Linux Server Aus: 8.6, 9.2
RedHat Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions: 8.6, 8.8, 9.2
RedHat Enterprise Linux Server Tus: 8.6, 8.8
RedHat Enterprise Linux Update Services For Sap Solutions: 8.6, 8.8

How to fix

Upgrade to a fixed version: Red Hat 389 Directory Server 2.2.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-1062 or the next vulnerability affects your stack