Red Hat Directory Server 13 vulnerabilities
16 known vulnerabilities in Red Hat Directory Server 13 from Red Hat. 16 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.0 Critical severity
Red Hat Directory Server 11: Improper Restriction of Communication Channel to Intended Endpoints
A flaw was found in 389-ds-base. The server does not discard plaintext bytes already buffered from a client connection when negotiating StartTLS, allowing an on-path attacker to inject a crafted LDAP message that is processed after the TLS upgrade and whose re
- 7.5 High severity
Red Hat Directory Server 11: Uncontrolled Resource Consumption
A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an incomplete LDAPMessage on the same connection, causing the server to hand that connection to a second worker thread before
- 9.8 Critical severity
Red Hat Directory Server 11.5 E4S for RHEL 8: Improper Authentication
A flaw was found in 389 Directory Server. During SASL PLAIN authentication, a stale identity carried in a Cyrus SASL auxiliary property from a prior failed bind attempt can be installed on a connection following a subsequent, unrelated successful bind, regardl
- 7.5 High severity
Red Hat Directory Server 11.5 E4S for RHEL 8: NULL Pointer Dereference
A flaw was found in 389 Directory Server. A missing NULL pointer check in the paged results handling of op_shared_search allows an unauthenticated remote attacker to crash the LDAP server by sending a crafted sequence of search requests using the USE_ONE_BACKE
- 7.5 High severity
Red Hat Directory Server 11.5 E4S for RHEL 8: Integer Underflow (Wrap or Wraparound)
A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), the wrapped-record length read from the wire is validated only against an upper bound. A small wire length (0, 1, or 2) produces an en
- 7.5 High severity
Red Hat Directory Server 11.5 E4S for RHEL 8: Incorrect Authorization
A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value, allowing an unauthenticated client to satisfy access control checks intended to r
- 7.5 High severity
Red Hat Directory Server 11.5 E4S for RHEL 8: Stack-based Buffer Overflow
A stack buffer overflow flaw was found in 389 Directory Server (389-ds-base). The get_ruvelement_from_berval() function in repl5_ruv.c copies digit characters from a network-supplied RUV berval into a fixed 16-byte stack buffer without bounds checking. A remot
- 7.5 High severity
Red Hat Directory Server 11.5 E4S for RHEL 8: Improper Neutralization of Special Elements used in an LDAP Query
A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler performs the search against cn=config with elevated replication pl
- 8.8 High severity
389-ds-base: Heap-based Buffer Overflow
A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). After a successful SASL bind with integrity protection (SSF > 0), an authenticated attacker can send a specially crafted oversized LDAP UNBIND packet that is cop
- 7.6 High severity
Red Hat Directory Server 11.5 E4S for RHEL 8: Integer Overflow or Wraparound
An integer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), adding sizeof(uint32_t) to a crafted SASL packet length prefix of 0xFFFFFFFC causes unsigned wraparound to zero, bypassing the nsslapd-ma
- 7.5 High severity
Red Hat Directory Server 11.5 E4S for RHEL 8: NULL Pointer Dereference
A flaw was found in 389 Directory Server. The dereference control plugin does not check for allocation failure before using a BER structure, allowing an unauthenticated remote attacker to crash the LDAP server when the system is under memory pressure.
- 7.5 High severity
Red Hat Directory Server 11.5 E4S for RHEL 8: Allocation of Resources Without Limits or Throttling
A flaw was found in 389-ds-base. The get_ldapmessage_controls_ext() function in the LDAP server does not enforce an upper bound on the number of controls per LDAP message. A remote, unauthenticated attacker can send a specially crafted LDAP request containing
- 9.8 Critical severity
flatted: Improperly Controlled Modification of Object Prototype Attributes
flatted is a circular JSON parser. Prior to version 3.4.2, the parse() function in flatted can use attacker-controlled string values from the parsed JSON as direct array index keys, without validating that they are numeric. Since the internal input buffer is a
- 7.5 High severity
flatted: Uncontrolled Recursion
flatted is a circular JSON parser. Prior to 3.4.0, flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential $ indices, the recursion dept
- 7.2 High severity
Red Hat Directory Server 11.5 E4S for RHEL 8: Heap-based Buffer Overflow
A flaw was found in the 389-ds-base server. A heap buffer overflow vulnerability exists in the `schema_attr_enum_callback` function within the `schema.c` file. This occurs because the code incorrectly calculates the buffer size by summing alias string lengths
- 7.8 High severity
Fence Agents Remediation Operator: Deserialization of Untrusted Data
An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the `picklefile` parameter in the `yacc()` function. This parameter accepts a `.pkl` file that is deserialized with `pickle.load()` without vali