CVE-2022-2850 — NULL Pointer Dereference in 389-ds-base

CWE-476 — NULL Pointer Dereference6 documents6 sources
Severity
6.5MEDIUMNVD
EPSS
0.3%
top 43.35%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Port389 389-ds-baseDebian LinuxFedoraproject Fedora+2 more
Timeline
PublishedOct 14

Description

A flaw was found In 389-ds-base. When the Content Synchronization plugin is enabled, an authenticated user can reach a NULL pointer dereference using a specially crafted query. This flaw allows an authenticated attacker to cause a denial of service. This CVE is assigned against an incomplete fix of CVE-2021-3514.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages4 packages

▶Debianport389/389-ds-base< 1.4.4.11-2+deb11u1+2
▶NVDport389/389-ds-base2.0.0 — 2.4.1
▶CVEListV5port389/389-ds-base389-ds-base-2.0.x+
▶NVDredhat/directory_server11.0, 12.0+1

Also affects: Debian Linux 10.0, Fedora 35, 36, Enterprise Linux 6.0, 7.0, 8.0, 9.0

🔴Vulnerability Details

3
OSV
CVE-2022-2850: A flaw was found In 389-ds-base↗2022-10-14
▶
CVEList
CVE-2022-2850: A flaw was found In 389-ds-base↗2022-10-14
▶
GHSA
GHSA-6c63-4574-7p9f: A flaw was found In 389-ds-base↗2022-10-14
▶

📋Vendor Advisories

2
Red Hat
389-ds-base: SIGSEGV in sync_repl↗2022-08-04
▶
Debian
CVE-2022-2850: 389-ds-base - A flaw was found In 389-ds-base. When the Content Synchronization plugin is enab...↗2022
▶
CVE-2022-2850 — NULL Pointer Dereference in 389-ds-base | cvebase