CVE-2021-4091

CWE-4156 documents6 sources
Severity
7.5HIGH
EPSS
0.3%
top 43.13%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
8
Port389 389-ds-baseRedhat Enterprise Linux DesktopRedhat Enterprise Linux FOR IBM Z Systems+5 more
Timeline
PublishedFeb 18
Latest updateFeb 19

Description

A double-free was found in the way 389-ds-base handles virtual attributes context in persistent searches. An attacker could send a series of search requests, forcing the server to behave unexpectedly, and crash.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages6 packages

▶NVDport389/389-ds-base< 1.3.10.2
▶Debian389-ds-base< 1.4.4.11-2+deb11u1+2
▶CVEListV5389-ds-base389-ds-base-1.3.10.2

Also affects: Enterprise Linux 7.0

Patches

Patch: bugzilla.redhat.com ↗Patch: bugzilla.redhat.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-qwhp-2gp7-qhfq: A double-free was found in the way 389-ds-base handles virtual attributes context in persistent searches↗2022-02-19
▶
OSV
CVE-2021-4091: A double-free was found in the way 389-ds-base handles virtual attributes context in persistent searches↗2022-02-18
▶
CVEList
CVE-2021-4091: A double-free was found in the way 389-ds-base handles virtual attributes context in persistent searches↗2022-02-18
▶

📋Vendor Advisories

2
Red Hat
389-ds-base: double free of the virtual attribute context in persistent search↗2022-01-27
▶
Debian
CVE-2021-4091: 389-ds-base - A double-free was found in the way 389-ds-base handles virtual attributes contex...↗2021
▶