What’s Vulnerable › Vulnerabilities

CVE-2024-2199: 389-ds-base: malformed userpassword may cause crash at do_modify in slapd/modify.c

• Severity: medium (CVSS 5.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-05-28 · updated 2026-06-26
• Weakness: CWE-20

Description

A denial of service vulnerability was found in 389-ds-base ldap server. This issue may allow an authenticated user to cause a server crash while modifying `userPassword` using malformed input.

Affected products

• Red Hat Directory Server 11.5 E4S for RHEL 8: all versions — fixed in 8060020250210084424.0ca98e7e
• Red Hat Directory Server 11.8 for RHEL 8: all versions — fixed in 8090020240606122459.91529cd0
• Red Hat Directory Server 11.9 for RHEL 8: all versions — fixed in 8100020240604161237.37ed7c03
• Red Hat Directory Server 12.4 for RHEL 9: all versions — fixed in 9040020240604143706.1674d574
• Red Hat Enterprise Linux 7: all versions — fixed in 0:1.3.11.1-5.el7_9
• Red Hat Enterprise Linux 8: all versions — fixed in 8100020240613122040.25e700aa
• Red Hat Enterprise Linux 8.8 Extended Update Support: all versions — fixed in 8080020240807050952.6dbb3803
• Red Hat Enterprise Linux 9: all versions — fixed in 0:2.4.5-8.el9_4
• Red Hat Enterprise Linux 9.2 Extended Update Support: all versions — fixed in 0:2.2.4-9.el9_2

How to fix

Upgrade to a fixed version: Red Hat Directory Server 11.5 E4S for RHEL 8 8060020250210084424.0ca98e7e; Red Hat Directory Server 11.8 for RHEL 8 8090020240606122459.91529cd0; Red Hat Directory Server 11.9 for RHEL 8 8100020240604161237.37ed7c03; Red Hat Directory Server 12.4 for RHEL 9 9040020240604143706.1674d574; Red Hat Enterprise Linux 7 0:1.3.11.1-5.el7_9; Red Hat Enterprise Linux 8 8100020240613122040.25e700aa; Red Hat Enterprise Linux 8.8 Extended Update Support 8080020240807050952.6dbb3803; Red Hat Enterprise Linux 9 0:2.4.5-8.el9_4; Red Hat Enterprise Linux 9.2 Extended Update Support 0:2.2.4-9.el9_2. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHSA-2024:3591
• https://access.redhat.com/errata/RHSA-2024:3837
• https://access.redhat.com/errata/RHSA-2024:4092
• https://access.redhat.com/errata/RHSA-2024:4209
• https://access.redhat.com/errata/RHSA-2024:4210
• https://access.redhat.com/errata/RHSA-2024:4235
• https://access.redhat.com/errata/RHSA-2024:4633
• https://access.redhat.com/errata/RHSA-2024:5690
• https://access.redhat.com/errata/RHSA-2025:1632
• https://access.redhat.com/security/cve/CVE-2024-2199
• https://bugzilla.redhat.com/show_bug.cgi?id=2267976
• https://www.port389.org/docs/389ds/releases/release-3-1-1.html

Get alerted when CVE-2024-2199 or the next vulnerability affects your stack