CVE-2024-5953
published 2024-06-18CVE-2024-5953: A denial of service vulnerability was found in the 389-ds-base LDAP server. This issue may allow an authenticated user to cause a server denial of service…
PriorityP420medium5.7CVSS 3.1
AVAACLPRLUINSUCNINAH
EPSS
0.57%
43.6th percentile
A denial of service vulnerability was found in the 389-ds-base LDAP server. This issue may allow an authenticated user to cause a server denial of service while attempting to log in with a user with a malformed hash in their password.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | 389-ds-base | < 389-ds-base 2.3.1+dfsg1-1+deb12u1 (bookworm) | 389-ds-base 2.3.1+dfsg1-1+deb12u1 (bookworm) |
| port389 | 389-ds-base | >= 0 < 1.4.4.11-2+deb11u1 | 1.4.4.11-2+deb11u1 |
| port389 | 389-ds-base | >= 0 < 2.3.1+dfsg1-1+deb12u1 | 2.3.1+dfsg1-1+deb12u1 |
| port389 | 389-ds-base | >= 0 < 3.1.1+dfsg1-1 | 3.1.1+dfsg1-1 |
CVSS provenance
nvdv3.15.7MEDIUMCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.7MEDIUM
vendor_debian5.7MEDIUM
vendor_redhat5.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2024-5953: A denial of service vulnerability was found in the 389-ds-base LDAP server
osv·2024-06-18·CVSS 5.7
CVE-2024-5953 [MEDIUM] CVE-2024-5953: A denial of service vulnerability was found in the 389-ds-base LDAP server
A denial of service vulnerability was found in the 389-ds-base LDAP server. This issue may allow an authenticated user to cause a server denial of service while attempting to log in with a user with a malformed hash in their password.
GHSA
GHSA-9h7v-6cr6-hcpx: A denial of service vulnerability was found in the 389-ds-base LDAP server
ghsa_unreviewed·2024-06-18
CVE-2024-5953 [MEDIUM] CWE-1288 GHSA-9h7v-6cr6-hcpx: A denial of service vulnerability was found in the 389-ds-base LDAP server
A denial of service vulnerability was found in the 389-ds-base LDAP server. This issue may allow an authenticated user to cause a server denial of service while attempting to log in with a user with a malformed hash in their password.
Red Hat
389-ds-base: Malformed userPassword hash may cause Denial of Service
vendor_redhat·2024-06-13·CVSS 5.7
CVE-2024-5953 [MEDIUM] CWE-1288 389-ds-base: Malformed userPassword hash may cause Denial of Service
389-ds-base: Malformed userPassword hash may cause Denial of Service
A denial of service vulnerability was found in the 389-ds-base LDAP server. This issue may allow an authenticated user to cause a server denial of service while attempting to log in with a user with a malformed hash in their password.
A denial of service vulnerability was found in the 389-ds-base LDAP server. This issue may allow an authenticated user to cause a server denial of service while attempting to log in with a user with a malformed hash in their password.
Statement: LDAP servers are not usually exposed to the open internet, requiring adjacent connectivity for a successful attack. This issue also requires a compromised user account to perform the attack. Therefore, this flaw is rated as a Moderate severity.
M
Debian
CVE-2024-5953: 389-ds-base - A denial of service vulnerability was found in the 389-ds-base LDAP server. This...
vendor_debian·2024·CVSS 5.7
CVE-2024-5953 [MEDIUM] CVE-2024-5953: 389-ds-base - A denial of service vulnerability was found in the 389-ds-base LDAP server. This...
A denial of service vulnerability was found in the 389-ds-base LDAP server. This issue may allow an authenticated user to cause a server denial of service while attempting to log in with a user with a malformed hash in their password.
Scope: local
bookworm: resolved (fixed in 2.3.1+dfsg1-1+deb12u1)
bullseye: resolved (fixed in 1.4.4.11-2+deb11u1)
sid: resolved (fixed in 3.1.1+dfsg1-1)
trixie: resolved (fixed in 3.1.1+dfsg1-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-11790 389-ds-base: 389-ds-base: PBKDF2 password storage plugin unbounded iteration count denial of service [fedora-all]
bugzilla·2026-06-30·CVSS 5.7
CVE-2026-11790 [MEDIUM] CVE-2026-11790 389-ds-base: 389-ds-base: PBKDF2 password storage plugin unbounded iteration count denial of service [fedora-all]
CVE-2026-11790 389-ds-base: 389-ds-base: PBKDF2 password storage plugin unbounded iteration count denial of service [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The PBKDF2-SHA256 password storage plugin in 389 Directory Server extracts the iteration count from stored password hashes without an upper bound check. An attacker with Directory Manager privileges can plant a crafted {PBKDF2_SHA256} hash with extreme iteration counts (e.g. 0x7FFFFFFF). Any subsequent LDAP BIND as the poisoned account triggers unbounded CPU consumption, hanging a worker thread for hours and enabling persistent denial of ser
Bugzilla
CVE-2026-11789 389-ds-base: 389-ds-base: SMD5 password storage plugin salt length integer underflow crash [fedora-all]
bugzilla·2026-06-30·CVSS 5.7
CVE-2026-11789 [MEDIUM] CVE-2026-11789 389-ds-base: 389-ds-base: SMD5 password storage plugin salt length integer underflow crash [fedora-all]
CVE-2026-11789 389-ds-base: 389-ds-base: SMD5 password storage plugin salt length integer underflow crash [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The SMD5 password storage plugin in 389 Directory Server computes salt length by subtracting MD5_LENGTH (16) from the decoded hash length using unsigned 32-bit arithmetic. When the stored hash is shorter than 16 bytes, the subtraction wraps to approximately 4GB. PK11_DigestOp() then reads from a small stack buffer into unmapped memory, crashing ns-slapd with SIGSEGV.
An attacker with Directory Manager privileges plants a crafted SMD5 hash; any subseq
Bugzilla
CVE-2026-11789 389-ds-base: 389-ds-base: SMD5 password storage plugin salt length integer underflow crash
bugzilla·2026-06-05·CVSS 5.7
CVE-2026-11789 [MEDIUM] CVE-2026-11789 389-ds-base: 389-ds-base: SMD5 password storage plugin salt length integer underflow crash
CVE-2026-11789 389-ds-base: 389-ds-base: SMD5 password storage plugin salt length integer underflow crash
The SMD5 password storage plugin in 389 Directory Server computes salt length by subtracting MD5_LENGTH (16) from the decoded hash length using unsigned 32-bit arithmetic. When the stored hash is shorter than 16 bytes, the subtraction wraps to approximately 4GB. PK11_DigestOp() then reads from a small stack buffer into unmapped memory, crashing ns-slapd with SIGSEGV.
An attacker with Directory Manager privileges plants a crafted SMD5 hash; any subsequent BIND triggers instant crash. Missed variant of CVE-2024-5953 which patched md5_pwd.c and pbkdf2_pwd.c but not smd5_pwd.c.
Present since smd5_pwd.c creation (~2005). PoC confirmed on Fedora 42 production binary.
Bugzilla
CVE-2026-11790 389-ds-base: 389-ds-base: PBKDF2 password storage plugin unbounded iteration count denial of service
bugzilla·2026-06-05·CVSS 5.7
CVE-2026-11790 [MEDIUM] CVE-2026-11790 389-ds-base: 389-ds-base: PBKDF2 password storage plugin unbounded iteration count denial of service
CVE-2026-11790 389-ds-base: 389-ds-base: PBKDF2 password storage plugin unbounded iteration count denial of service
The PBKDF2-SHA256 password storage plugin in 389 Directory Server extracts the iteration count from stored password hashes without an upper bound check. An attacker with Directory Manager privileges can plant a crafted {PBKDF2_SHA256} hash with extreme iteration counts (e.g. 0x7FFFFFFF). Any subsequent LDAP BIND as the poisoned account triggers unbounded CPU consumption, hanging a worker thread for hours and enabling persistent denial of service.
Both the C plugin (pbkdf2_pwd.c) and Rust plugin (pwdchan/lib.rs) are affected. Distinct from CVE-2024-5953 which added hash length check but not iteration cap.
Introduced in 389-ds-base 1.3.6 (commit 542287ce7, Ticket 397). PoC c
https://access.redhat.com/errata/RHSA-2024:4633https://access.redhat.com/errata/RHSA-2024:4997https://access.redhat.com/errata/RHSA-2024:5192https://access.redhat.com/errata/RHSA-2024:5690https://access.redhat.com/errata/RHSA-2024:6153https://access.redhat.com/errata/RHSA-2024:6568https://access.redhat.com/errata/RHSA-2024:6569https://access.redhat.com/errata/RHSA-2024:6576https://access.redhat.com/errata/RHSA-2024:7458https://access.redhat.com/errata/RHSA-2025:1632https://access.redhat.com/security/cve/CVE-2024-5953https://bugzilla.redhat.com/show_bug.cgi?id=2292104https://access.redhat.com/errata/RHSA-2024:4633https://access.redhat.com/security/cve/CVE-2024-5953https://bugzilla.redhat.com/show_bug.cgi?id=2292104https://lists.debian.org/debian-lts-announce/2025/01/msg00015.html
2024-06-18
Published