REDHAT-BUG-2293579: Medium severity red hat directory server vulnerability
Summary: An unauthenticated user can cause a systematic server crash while sending a specific extended search request.
Description: 389-ds-base in RHEL 9.4 - RHDS 12.4, supports a new matching rule (inchain or 1.2.840.113556.1.4.1941). This matching rule requires that the matching attribute has a DN syntax. If the attribute in the ldap client request is not DN syntax, the server logs a message. The format of the message requires an attribute but as the attribute is missing, it triggers a SEGV.
Steps to reproduce: See below
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2293579?
The severity of REDHAT-BUG-2293579 is critical as it allows unauthenticated users to crash the server.
How do I fix REDHAT-BUG-2293579?
To fix REDHAT-BUG-2293579, upgrade to the latest version of the Red Hat 389 Directory Server.
What are the potential impacts of REDHAT-BUG-2293579?
The potential impacts of REDHAT-BUG-2293579 include service disruption and system downtime due to server crashes.
Who is affected by REDHAT-BUG-2293579?
Users of Red Hat 389 Directory Server version 12.4 in RHEL 9.4 are affected by REDHAT-BUG-2293579.
Is REDHAT-BUG-2293579 exploitability easy?
Yes, REDHAT-BUG-2293579 has a low barrier to exploit as it can be triggered by unauthenticated users.