CVE-2018-10935: Input Validation
First published: Wed Aug 08 2018(Updated: )
A flaw was found in the 389 Directory Server that allows users to cause a crash in the LDAP server using ldapsearch with server side sort.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Redhat 389 Directory Server | >=1.3.0.0<1.3.8.7 | |
| Redhat 389 Directory Server | >=1.4.0.0<1.4.0.14 | |
| redhat/389-ds-base | <1.3.8.7 | 1.3.8.7 |
| redhat/389-ds-base | <1.4.0.14 | 1.4.0.14 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00033.html
- https://access.redhat.com/errata/RHSA-2018:2757
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10935
- https://lists.debian.org/debian-lts-announce/2018/08/msg00032.html
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1607078
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1613607
- https://pagure.io/389-ds-base/issue/49890
- https://pagure.io/fork/mreynolds/389-ds-base/c/c989e18f7a3da060b16d39919b920b6b2a19a0ac
- http://www.port389.org/docs/389ds/releases/release-1-3-8-7.html
- http://www.port389.org/docs/389ds/releases/release-1-4-0-14.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1613606
Frequently Asked Questions
What is CVE-2018-10935?
CVE-2018-10935 is a vulnerability in the 389 Directory Server that allows users to cause a crash in the LDAP server using ldapsearch with server-side sort.
How does CVE-2018-10935 affect 389 Directory Server?
CVE-2018-10935 affects versions 1.3.0.0 up to, but excluding, 1.3.8.7 and versions 1.4.0.0 up to, but excluding, 1.4.0.14 of 389 Directory Server.
What is the severity of CVE-2018-10935?
CVE-2018-10935 has a severity score of 6.5 (medium).
How can I fix CVE-2018-10935?
To fix CVE-2018-10935, update your 389 Directory Server to version 1.3.8.7 or higher if you are using version 1.3.x, or update to version 1.4.0.14 or higher if you are using version 1.4.x.
Where can I find more information about CVE-2018-10935?
You can find more information about CVE-2018-10935 in the following references: [bugzilla.redhat.com/show_bug.cgi?id=1607078](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1607078), [bugzilla.redhat.com/show_bug.cgi?id=1613607](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1613607), [pagure.io/389-ds-base/issue/49890](https://pagure.io/389-ds-base/issue/49890).
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/type
- agent/weakness
- collector/nvd-index
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2018-10935
- agent/software-canonical-lookup
- vendor/redhat
- canonical/redhat 389 directory server
- version/redhat 389 directory server/1.3.0.0
- version/redhat 389 directory server/1.4.0.0
- package-manager/redhat