CVE-2025-2487: 389-ds-base: null pointer dereference leads to denial of service
A flaw was found in 389-ds-base. The problem occurs when issuing a Modify DN LDAP operation through the ldap protocol (using a TCP-IP or Unix socket as defined in the LDAP RFC https://datatracker.ietf.org/doc/html/rfc4511#section-4.9) If it moves an ldap entry in the DIT at the same time that a failing operation impacts its parent entry.
Other sources
A flaw was found in the 389-ds-base LDAP Server. This issue occurs when issuing a Modify DN LDAP operation through the ldap protocol, when the function return value is not tested and a NULL pointer is dereferenced. If a privileged user performs a ldap MODDN operation after a failed operation, it could lead to a Denial of Service (DoS) or system crash.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable or restrict Modify DN (MODDN) LDAP operations or remove modify DN privileges from accounts that do not require them until a vendor-provided fix is available.
389-ds-base (LDAP server) Modify DN (MODDN) operations = disabled or restricted to trusted administrators - Compensating control
Restrict access to the LDAP service (LDAP over TCP or Unix socket) to trusted management hosts/IPs using firewall rules, host-based ACLs, or socket permissions to prevent untrusted users or networks from issuing MODDN operations until a fix is applied.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-2487?
CVE-2025-2487 has been classified with a high severity rating due to its potential impact on LDAP operations.
How do I fix CVE-2025-2487?
To fix CVE-2025-2487, it is recommended to update the 389-ds-base package to the latest version provided by Red Hat.
What systems are affected by CVE-2025-2487?
CVE-2025-2487 affects systems running the Red Hat Directory Server version of 389-ds-base.
What specific operations are vulnerable in CVE-2025-2487?
CVE-2025-2487 specifically affects the Modify DN LDAP operation when performed through the LDAP protocol.
Is there a workaround for CVE-2025-2487?
Currently, no specific workaround is provided for CVE-2025-2487; updating the software is the recommended action.