CVE-2024-6237 — Improper Handling of Missing Values in Redhat Directory Server

CWE-230 — Improper Handling of Missing Values6 documents6 sources
Severity
6.5MEDIUMNVD
EPSS
0.8%
top 25.64%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Port389 389-ds-baseRedhat Directory ServerRedhat Enterprise Linux
Timeline
PublishedJul 9

Description

A flaw was found in the 389 Directory Server. This flaw allows an unauthenticated user to cause a systematic server crash while sending a specific extended search request, leading to a denial of service.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

▶Debianport389/389-ds-base< 2.4.5+dfsg1-1

Also affects: Enterprise Linux 9.0

🔴Vulnerability Details

3
GHSA
GHSA-2fpj-qhmc-jpvc: A flaw was found in the 389 Directory Server↗2024-07-09
▶
CVEList
389-ds-base: unauthenticated user can trigger a dos by sending a specific extended search request↗2024-07-09
▶
OSV
CVE-2024-6237: A flaw was found in the 389 Directory Server↗2024-07-09
▶

📋Vendor Advisories

2
Red Hat
389-ds-base: unauthenticated user can trigger a DoS by sending a specific extended search request↗2024-07-09
▶
Debian
CVE-2024-6237: 389-ds-base - A flaw was found in the 389 Directory Server. This flaw allows an unauthenticate...↗2024
▶
CVE-2024-6237 — Improper Handling of Missing Values | cvebase