REDHAT-BUG-454065: Low severity red hat directory server vulnerability
It was discovered that Red Hat Directory Server and Fedora Directory Server is prone to a temporary denial of service attack (high CPU usage) via crafted LDAP search patterns. LDAP search patterns are internally translated to regular expressions. If the regular expression is matched against specially crafted record already stored in the LDAP, it may cause regular expression NFA to iterate over large amount of states, causing one slapd thread to occupy CPU for excessive amount of time.
Additionally, due to a current design of the regular expression handling code, only one slapd thread can execute regular expression NFA code at the time. Because of that, during the processing of such CPU intensive search request, all other search requests using patterns are blocked.
Affected version: Red Hat Directory Server 7.1 and 8 Fedora Directory Server 1.1.1
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-454065?
The severity of REDHAT-BUG-454065 is considered high due to its potential to cause a temporary denial of service by consuming CPU resources.
How do I fix REDHAT-BUG-454065?
To fix REDHAT-BUG-454065, it is recommended to apply updates or patches provided by Red Hat for affected versions of the Directory Server.
Which versions are affected by REDHAT-BUG-454065?
REDHAT-BUG-454065 affects Red Hat Directory Server versions from 7.1 up to 8, as well as Fedora Directory Server.
What type of attack is associated with REDHAT-BUG-454065?
REDHAT-BUG-454065 is associated with a temporary denial of service attack triggered by crafted LDAP search patterns.
Is there an official reference for REDHAT-BUG-454065?
Yes, you can find official details in the Red Hat Bugzilla entry for REDHAT-BUG-454065.