CVE-2021-4091: Double Free
First published: Wed Dec 08 2021(Updated: )
A double-free was found in the way 389-ds-base handles virtual attributes context in persistent searches. An attacker could send a series of search requests, forcing the server to behave unexpectedly, and crash.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Port389 389-ds-base | <1.3.10.2 | |
| Redhat Enterprise Linux Desktop | =7 | |
| Redhat Enterprise Linux For Ibm Z Systems | =7.0 | |
| Redhat Enterprise Linux For Power Big Endian | =7.0 | |
| Redhat Enterprise Linux For Power Little Endian | =7.0 | |
| Redhat Enterprise Linux For Scientific Computing | =7.0 | |
| Redhat Enterprise Linux Server | =7.0 | |
| Redhat Enterprise Linux Workstation | =7.0 | |
| redhat/389-ds-base | <2.2.0 | 2.2.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi?id=2030307
- https://lists.debian.org/debian-lts-announce/2023/04/msg00026.html
- https://github.com/389ds/389-ds-base/commit/74c666b83e3e1789c2ef3f7935c327bd7555193e
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2047261
- https://access.redhat.com/errata/RHSA-2022:0628
- https://access.redhat.com/errata/RHSA-2022:0889
- https://access.redhat.com/errata/RHSA-2022:0952
- https://access.redhat.com/security/cve/cve-2021-4091
- https://github.com/389ds/389-ds-base/commit/a3c298f8140d3e4fa1bd5a670f1bb965a21a9b7b
- https://access.redhat.com/errata/RHSA-2022:1410
Frequently Asked Questions
What is the severity of CVE-2021-4091?
The severity of CVE-2021-4091 is high with a severity value of 7.5.
What is the affected software for CVE-2021-4091?
The affected software for CVE-2021-4091 includes Port389 389-ds-base version up to exclusive 1.3.10.2, Redhat Enterprise Linux Desktop 7, Redhat Enterprise Linux For Ibm Z Systems 7.0, Redhat Enterprise Linux For Power Big Endian 7.0, Redhat Enterprise Linux For Power Little Endian 7.0, Redhat Enterprise Linux For Scientific Computing 7.0, Redhat Enterprise Linux Server 7.0, and Redhat Enterprise Linux Workstation 7.0.
How can an attacker exploit CVE-2021-4091?
An attacker can exploit CVE-2021-4091 by sending a series of search requests to the server, forcing it to behave unexpectedly and crash.
What is the Common Weakness Enumeration (CWE) ID for CVE-2021-4091?
The Common Weakness Enumeration (CWE) ID for CVE-2021-4091 is CWE-415.
Where can I find more information about CVE-2021-4091?
You can find more information about CVE-2021-4091 at the following references: [Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=2030307) and [Debian LTS Announce](https://lists.debian.org/debian-lts-announce/2023/04/msg00026.html).
- collector/nvd-index
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/remedy
- agent/last-modified-date
- agent/author
- agent/references
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2021-4091
- agent/software-canonical-lookup
- agent/severity
- agent/description
- agent/softwarecombine
- agent/first-publish-date
- agent/event
- agent/tags
- vendor/port389
- canonical/port389 389-ds-base
- vendor/redhat
- canonical/redhat enterprise linux desktop
- version/redhat enterprise linux desktop/7
- canonical/redhat enterprise linux for ibm z systems
- version/redhat enterprise linux for ibm z systems/7.0
- canonical/redhat enterprise linux for power big endian
- version/redhat enterprise linux for power big endian/7.0
- canonical/redhat enterprise linux for power little endian
- version/redhat enterprise linux for power little endian/7.0
- canonical/redhat enterprise linux for scientific computing
- version/redhat enterprise linux for scientific computing/7.0
- canonical/redhat enterprise linux server
- version/redhat enterprise linux server/7.0
- canonical/redhat enterprise linux workstation
- version/redhat enterprise linux workstation/7.0
- package-manager/redhat