CVE-2024-8445: 389-ds-base: server crash while modifying `userpassword` using malformed input (incomplete fix for cve-2024-2199)

Severity: medium (CVSS 5.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-09-05 · updated 2026-06-17
Weakness: CWE-20

Description

The fix for CVE-2024-2199 in 389-ds-base was insufficient to cover all scenarios. In certain product versions, an authenticated user may cause a server crash while modifying `userPassword` using malformed input.

Affected products

Red Hat Enterprise Linux 7 Extended Lifecycle Support: all versions — fixed in 0:1.3.11.1-7.el7_9

How to fix

Upgrade to a fixed version: Red Hat Enterprise Linux 7 Extended Lifecycle Support 0:1.3.11.1-7.el7_9. Check the vendor advisory for mitigations.

References

https://access.redhat.com/errata/RHSA-2024:7434
https://access.redhat.com/security/cve/CVE-2024-8445
https://bugzilla.redhat.com/show_bug.cgi?id=2310110
https://lists.debian.org/debian-lts-announce/2025/01/msg00015.html

Get alerted when CVE-2024-8445 or the next vulnerability affects your stack