CVE-2018-10850

published 2018-06-13

CVE-2018-10850: 389-ds-base before versions 1.4.0.10, 1.3.8.3 is vulnerable to a race condition in the way 389-ds-base handles persistent search, resulting in a crash if the…

Priority P4 27 medium 5.9 CVSS 3.0

AV N AC H PR N UI N S U C N I N A H

389-ds-base before versions 1.4.0.10, 1.3.8.3 is vulnerable to a race condition in the way 389-ds-base handles persistent search, resulting in a crash if the server is under load. An anonymous attacker could use this flaw to trigger a denial of service.

Affected

14 ranges

Vendor	Product	Version range	Fixed in
debian	389-ds-base	< 389-ds-base 1.4.0.15-1 (bookworm)	389-ds-base 1.4.0.15-1 (bookworm)
debian	debian_linux	—	—
fedoraproject	389_directory_server	< 1.4.0.10	1.4.0.10
port389	389-ds-base	>= 0 < 1.4.0.15-1	1.4.0.15-1
port389	389-ds-base	>= 0 < 1.4.0.15-1	1.4.0.15-1
port389	389-ds-base	>= 0 < 1.4.0.15-1	1.4.0.15-1
redhat	enterprise_linux	—	—
redhat	enterprise_linux_desktop	—	—
redhat	enterprise_linux_server	—	—
redhat	enterprise_linux_server_aus	—	—
redhat	enterprise_linux_server_eus	—	—
redhat	enterprise_linux_server_eus	—	—
redhat	enterprise_linux_server_tus	—	—
redhat	enterprise_linux_workstation	—	—

CVSS provenance

nvd v3.0 5.9 MEDIUM CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

nvd v2.0 7.1 HIGH AV:N/AC:M/Au:N/C:N/I:N/A:C

osv 5.9 MEDIUM

vendor_debian 5.9 MEDIUM

vendor_redhat 5.9 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-362