REDHAT-BUG-2485426: Low severity Red Hat 389-ds-base vulnerability
A heap out-of-bounds read exists in str2entrystateinformationfromtype() (entry.c) in the 389 Directory Server LDIF parser. When importing LDIF with attribute types containing trailing semicolons, the code accesses p[3] through p[6] after finding a semicolon via PLstrchr without verifying sufficient bytes remain in the allocation.
Requires local administrator access via ldif2db import. ASan-proven on instrumented builds; production binaries do not crash due to allocator padding. Present unchanged across all shipped 389-ds-base versions.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2485426?
The severity of REDHAT-BUG-2485426 is classified as low.
What kind of vulnerability is REDHAT-BUG-2485426?
REDHAT-BUG-2485426 is a heap out-of-bounds read vulnerability in the 389 Directory Server LDIF parser.
How does REDHAT-BUG-2485426 affect the system?
REDHAT-BUG-2485426 can lead to potential memory access issues when importing LDIF with improper attribute types.
How do I fix REDHAT-BUG-2485426?
To fix REDHAT-BUG-2485426, update to the recommended patch or version release provided by Red Hat for 389-ds-base.
What is the context of REDHAT-BUG-2485426?
REDHAT-BUG-2485426 pertains to an issue in the 389 Directory Server affecting the parsing of LDIF files with specific attribute formats.