medium
5.7
CWE
1288 119
EPSS
0.045%
Advisory Published
CVE Published
Updated

CVE-2024-5953: 389-ds-base: malformed userpassword hash may cause denial of service

First published: Thu Jun 13 2024(Updated: )

A denial of service vulnerability was found in 389-ds-base ldap server. This issue may allow an authenticated user to cause a server crash or hang while authenticating with an user having a malformed userPassword. By default only the administrator may directly add hashed password that can trigger the issue. But if nsslapd-allow-hashed-passwords config parameter is turned on, any user can trigger the issue. The problem is triggered by adding a password to an user using the hashed format (with a hash value too long for the specified hash scheme) Then later on when trying to authenticate on that user its triggers the buffer overflow By default, only administrators are allowed to add hashed passwords but there is a configuration parameter (nsslapd-allow-hashed-passwords) allowing any users to add hashed passwords and potentially trigger the DoS. This vulnerability affects versions: >= 1.3.7.2

Credit: secalert@redhat.com

Affected SoftwareAffected VersionHow to fix
389 Directory Server>=1.3.7.2

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the severity of CVE-2024-5953?

    CVE-2024-5953 is classified as a denial of service vulnerability that can lead to server crashes.

  • How do I fix CVE-2024-5953?

    To fix CVE-2024-5953, it is recommended to upgrade to the latest patched version of 389-ds-base.

  • Who is affected by CVE-2024-5953?

    CVE-2024-5953 affects users of the 389-ds-base LDAP server version 1.3.7.2 and later.

  • What causes the CVE-2024-5953 vulnerability?

    CVE-2024-5953 is caused by the server crashing or hanging when an authenticated user attempts to authenticate with a malformed userPassword.

  • Can unauthenticated users exploit CVE-2024-5953?

    No, CVE-2024-5953 requires an authenticated user to exploit the vulnerability.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203