CVE-2024-2199
Medium · 5.7CVSS
5.7
EPSS
0.6%
Published
May 28, 2024
CISA due date
—
Cloudanix analysis
Monitor only
SSVC: Track
A logged-in user can send specially crafted password data that knocks the directory server offline until someone restarts it.
- Exploitation
- Adjacent Network
- Attacker needs
- Low Privilege
- Complexity
- Low
- Impact
- Denial Of Service
- Component
- Network Service
- Class
- Denial of service
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
An authenticated LDAP client can supply a malformed userPassword attribute value during a modify operation, triggering an unhandled condition that causes the 389-ds-base server process to terminate.
Why it matters to the business
Directory services become unavailable until the LDAP server is restarted, interrupting authentication, authorization, and any applications that rely on the directory for identity data.
How an attack unfolds
An attacker who already possesses a valid LDAP bind account crafts a modify request containing an intentionally malformed userPassword value and sends it over an authenticated LDAP session; the server crashes on receipt, producing a denial of service.
How to fix it
Upgrade 389-ds-base to a version containing the fix for this denial-of-service condition; until a patched package is available, restrict modify access to userPassword to the smallest set of trusted accounts and monitor for abnormal server restarts.
How to confirm the fix worked
After applying the update, replay a modify request containing the previously crashing userPassword value from an authenticated session and confirm the server remains stable; also verify that the reported version string matches a known fixed release.
Typical attack path
- Obtain valid LDAP credentials for an account permitted to modify userPassword
- Connect to the 389-ds-base server over LDAP and bind with those credentials
- Issue a modify operation targeting a user entry and supplying a crafted, malformed userPassword attribute
- Observe server process termination and loss of LDAP service
How to detect it
Review 389-ds-base error and audit logs for modify operations on the userPassword attribute immediately preceding an abrupt server crash or restart; correlate LDAP connection timestamps with process termination events in system logs.
What your security team should do
- Apply the vendor-supplied update for 389-ds-base as soon as it becomes available
- Limit LDAP modify rights on userPassword to service accounts that require it
- Enable and retain detailed LDAP audit logging to capture modify operations
- Configure process monitoring to alert on unexpected 389-ds-base restarts
The record
A denial of service vulnerability was found in 389-ds-base ldap server. This issue may allow an authenticated user to cause a server crash while modifying `userPassword` using malformed input.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| AlmaLinux:8 | 389-ds-base | 0 | 1.4.3.39-7.module_el8.10.0+3864+d8eec553 |
| AlmaLinux:8 | 389-ds-base-devel | 0 | 1.4.3.39-7.module_el8.10.0+3864+d8eec553 |
| AlmaLinux:8 | 389-ds-base-legacy-tools | 0 | 1.4.3.39-7.module_el8.10.0+3864+d8eec553 |
| AlmaLinux:8 | 389-ds-base-libs | 0 | 1.4.3.39-7.module_el8.10.0+3864+d8eec553 |
| AlmaLinux:8 | 389-ds-base-snmp | 0 | 1.4.3.39-7.module_el8.10.0+3864+d8eec553 |
| AlmaLinux:8 | python3-lib389 | 0 | 1.4.3.39-7.module_el8.10.0+3864+d8eec553 |
| AlmaLinux:9 | 389-ds-base | 0 | 2.4.5-8.el9_4 |
| AlmaLinux:9 | 389-ds-base-devel | 0 | 2.4.5-8.el9_4 |
| AlmaLinux:9 | 389-ds-base-libs | 0 | 2.4.5-8.el9_4 |
| AlmaLinux:9 | python3-lib389 | 0 | 2.4.5-8.el9_4 |
| Debian:11 | 389-ds-base | 0 | No fix |
| Debian:11 | 389-ds-base | 0 | 1.4.4.11-2+deb11u1 |
| Debian:12 | 389-ds-base | 0 | No fix |
| Debian:13 | 389-ds-base | 0 | 3.1.1+dfsg1-1 |
| Red Hat:directory_server:11.8::el8 | 389-ds-base | 0 | 0:1.4.3.37-10.module+el8dsrv+21971+f7435891 |
| Red Hat:directory_server:11.8::el8 | 389-ds-base-debuginfo | 0 | 0:1.4.3.37-10.module+el8dsrv+21971+f7435891 |
| Red Hat:directory_server:11.8::el8 | 389-ds-base-debugsource | 0 | 0:1.4.3.37-10.module+el8dsrv+21971+f7435891 |
| Red Hat:directory_server:11.8::el8 | 389-ds-base-devel | 0 | 0:1.4.3.37-10.module+el8dsrv+21971+f7435891 |
| Red Hat:directory_server:11.8::el8 | 389-ds-base-legacy-tools | 0 | 0:1.4.3.37-10.module+el8dsrv+21971+f7435891 |
| Red Hat:directory_server:11.8::el8 | 389-ds-base-legacy-tools-debuginfo | 0 | 0:1.4.3.37-10.module+el8dsrv+21971+f7435891 |
| Red Hat:directory_server:11.8::el8 | 389-ds-base-libs | 0 | 0:1.4.3.37-10.module+el8dsrv+21971+f7435891 |
| Red Hat:directory_server:11.8::el8 | 389-ds-base-libs-debuginfo | 0 | 0:1.4.3.37-10.module+el8dsrv+21971+f7435891 |
| Red Hat:directory_server:11.8::el8 | 389-ds-base-snmp | 0 | 0:1.4.3.37-10.module+el8dsrv+21971+f7435891 |
| Red Hat:directory_server:11.8::el8 | 389-ds-base-snmp-debuginfo | 0 | 0:1.4.3.37-10.module+el8dsrv+21971+f7435891 |
| Red Hat:directory_server:11.8::el8 | cockpit-389-ds | 0 | 0:1.4.3.37-10.module+el8dsrv+21971+f7435891 |
| Red Hat:directory_server:11.8::el8 | python3-lib389 | 0 | 0:1.4.3.37-10.module+el8dsrv+21971+f7435891 |
| Red Hat:directory_server:11.9::el8 | 389-ds-base | 0 | 0:1.4.3.39-4.module+el8dsrv+21965+9ff26197 |
| Red Hat:directory_server:11.9::el8 | 389-ds-base-debuginfo | 0 | 0:1.4.3.39-4.module+el8dsrv+21965+9ff26197 |
| Red Hat:directory_server:11.9::el8 | 389-ds-base-debugsource | 0 | 0:1.4.3.39-4.module+el8dsrv+21965+9ff26197 |
| Red Hat:directory_server:11.9::el8 | 389-ds-base-devel | 0 | 0:1.4.3.39-4.module+el8dsrv+21965+9ff26197 |
| Red Hat:directory_server:11.9::el8 | 389-ds-base-legacy-tools | 0 | 0:1.4.3.39-4.module+el8dsrv+21965+9ff26197 |
| Red Hat:directory_server:11.9::el8 | 389-ds-base-legacy-tools-debuginfo | 0 | 0:1.4.3.39-4.module+el8dsrv+21965+9ff26197 |
| Red Hat:directory_server:11.9::el8 | 389-ds-base-libs | 0 | 0:1.4.3.39-4.module+el8dsrv+21965+9ff26197 |
| Red Hat:directory_server:11.9::el8 | 389-ds-base-libs-debuginfo | 0 | 0:1.4.3.39-4.module+el8dsrv+21965+9ff26197 |
| Red Hat:directory_server:11.9::el8 | 389-ds-base-snmp | 0 | 0:1.4.3.39-4.module+el8dsrv+21965+9ff26197 |
| Red Hat:directory_server:11.9::el8 | 389-ds-base-snmp-debuginfo | 0 | 0:1.4.3.39-4.module+el8dsrv+21965+9ff26197 |
| Red Hat:directory_server:11.9::el8 | cockpit-389-ds | 0 | 0:1.4.3.39-4.module+el8dsrv+21965+9ff26197 |
| Red Hat:directory_server:11.9::el8 | python3-lib389 | 0 | 0:1.4.3.39-4.module+el8dsrv+21965+9ff26197 |
| Red Hat:directory_server:12.4::el9 | 389-ds-base | 0 | 0:2.4.5-4.module+el9dsrv+21964+c7e95493 |
| Red Hat:directory_server:12.4::el9 | 389-ds-base-debuginfo | 0 | 0:2.4.5-4.module+el9dsrv+21964+c7e95493 |
| Red Hat:directory_server:12.4::el9 | 389-ds-base-debugsource | 0 | 0:2.4.5-4.module+el9dsrv+21964+c7e95493 |
| Red Hat:directory_server:12.4::el9 | 389-ds-base-devel | 0 | 0:2.4.5-4.module+el9dsrv+21964+c7e95493 |
| Red Hat:directory_server:12.4::el9 | 389-ds-base-libs | 0 | 0:2.4.5-4.module+el9dsrv+21964+c7e95493 |
| Red Hat:directory_server:12.4::el9 | 389-ds-base-libs-debuginfo | 0 | 0:2.4.5-4.module+el9dsrv+21964+c7e95493 |
| Red Hat:directory_server:12.4::el9 | 389-ds-base-snmp | 0 | 0:2.4.5-4.module+el9dsrv+21964+c7e95493 |
| Red Hat:directory_server:12.4::el9 | 389-ds-base-snmp-debuginfo | 0 | 0:2.4.5-4.module+el9dsrv+21964+c7e95493 |
| Red Hat:directory_server:12.4::el9 | cockpit-389-ds | 0 | 0:2.4.5-4.module+el9dsrv+21964+c7e95493 |
| Red Hat:directory_server:12.4::el9 | python3-lib389 | 0 | 0:2.4.5-4.module+el9dsrv+21964+c7e95493 |
| Red Hat:enterprise_linux:7::client | 389-ds-base | 0 | 0:1.3.11.1-5.el7_9 |
| Red Hat:enterprise_linux:7::client | 389-ds-base-debuginfo | 0 | 0:1.3.11.1-5.el7_9 |
| Red Hat:enterprise_linux:7::client | 389-ds-base-devel | 0 | 0:1.3.11.1-5.el7_9 |
| Red Hat:enterprise_linux:7::client | 389-ds-base-libs | 0 | 0:1.3.11.1-5.el7_9 |
| Red Hat:enterprise_linux:7::client | 389-ds-base-snmp | 0 | 0:1.3.11.1-5.el7_9 |
| Red Hat:enterprise_linux:7::computenode | 389-ds-base | 0 | 0:1.3.11.1-5.el7_9 |
| Red Hat:enterprise_linux:7::computenode | 389-ds-base-debuginfo | 0 | 0:1.3.11.1-5.el7_9 |
| Red Hat:enterprise_linux:7::computenode | 389-ds-base-devel | 0 | 0:1.3.11.1-5.el7_9 |
| Red Hat:enterprise_linux:7::computenode | 389-ds-base-libs | 0 | 0:1.3.11.1-5.el7_9 |
| Red Hat:enterprise_linux:7::computenode | 389-ds-base-snmp | 0 | 0:1.3.11.1-5.el7_9 |
| Red Hat:enterprise_linux:7::server | 389-ds-base | 0 | 0:1.3.11.1-5.el7_9 |
| Red Hat:enterprise_linux:7::server | 389-ds-base-debuginfo | 0 | 0:1.3.11.1-5.el7_9 |
| Red Hat:enterprise_linux:7::server | 389-ds-base-devel | 0 | 0:1.3.11.1-5.el7_9 |
| Red Hat:enterprise_linux:7::server | 389-ds-base-libs | 0 | 0:1.3.11.1-5.el7_9 |
| Red Hat:enterprise_linux:7::server | 389-ds-base-snmp | 0 | 0:1.3.11.1-5.el7_9 |
| Red Hat:enterprise_linux:7::workstation | 389-ds-base | 0 | 0:1.3.11.1-5.el7_9 |
| Red Hat:enterprise_linux:7::workstation | 389-ds-base-debuginfo | 0 | 0:1.3.11.1-5.el7_9 |
| Red Hat:enterprise_linux:7::workstation | 389-ds-base-devel | 0 | 0:1.3.11.1-5.el7_9 |
| Red Hat:enterprise_linux:7::workstation | 389-ds-base-libs | 0 | 0:1.3.11.1-5.el7_9 |
| Red Hat:enterprise_linux:7::workstation | 389-ds-base-snmp | 0 | 0:1.3.11.1-5.el7_9 |
| Red Hat:enterprise_linux:8::appstream | 389-ds-base | 0 | 0:1.4.3.39-7.module+el8.10.0+21985+3665ccdb |
| Red Hat:enterprise_linux:8::appstream | 389-ds-base-debuginfo | 0 | 0:1.4.3.39-7.module+el8.10.0+21985+3665ccdb |
| Red Hat:enterprise_linux:8::appstream | 389-ds-base-debugsource | 0 | 0:1.4.3.39-7.module+el8.10.0+21985+3665ccdb |
| Red Hat:enterprise_linux:8::appstream | 389-ds-base-devel | 0 | 0:1.4.3.39-7.module+el8.10.0+21985+3665ccdb |
| Red Hat:enterprise_linux:8::appstream | 389-ds-base-legacy-tools | 0 | 0:1.4.3.39-7.module+el8.10.0+21985+3665ccdb |
| Red Hat:enterprise_linux:8::appstream | 389-ds-base-legacy-tools-debuginfo | 0 | 0:1.4.3.39-7.module+el8.10.0+21985+3665ccdb |
| Red Hat:enterprise_linux:8::appstream | 389-ds-base-libs | 0 | 0:1.4.3.39-7.module+el8.10.0+21985+3665ccdb |
| Red Hat:enterprise_linux:8::appstream | 389-ds-base-libs-debuginfo | 0 | 0:1.4.3.39-7.module+el8.10.0+21985+3665ccdb |
| Red Hat:enterprise_linux:8::appstream | 389-ds-base-snmp | 0 | 0:1.4.3.39-7.module+el8.10.0+21985+3665ccdb |
| Red Hat:enterprise_linux:8::appstream | 389-ds-base-snmp-debuginfo | 0 | 0:1.4.3.39-7.module+el8.10.0+21985+3665ccdb |
| Red Hat:enterprise_linux:8::appstream | python3-lib389 | 0 | 0:1.4.3.39-7.module+el8.10.0+21985+3665ccdb |
| Red Hat:enterprise_linux:9::appstream | 389-ds-base | 0 | 0:2.4.5-8.el9_4 |
| Red Hat:enterprise_linux:9::appstream | 389-ds-base-debuginfo | 0 | 0:2.4.5-8.el9_4 |
| Red Hat:enterprise_linux:9::appstream | 389-ds-base-debugsource | 0 | 0:2.4.5-8.el9_4 |
| Red Hat:enterprise_linux:9::appstream | 389-ds-base-devel | 0 | 0:2.4.5-8.el9_4 |
| Red Hat:enterprise_linux:9::appstream | 389-ds-base-libs | 0 | 0:2.4.5-8.el9_4 |
| Red Hat:enterprise_linux:9::appstream | 389-ds-base-libs-debuginfo | 0 | 0:2.4.5-8.el9_4 |
| Red Hat:enterprise_linux:9::appstream | 389-ds-base-snmp-debuginfo | 0 | 0:2.4.5-8.el9_4 |
| Red Hat:enterprise_linux:9::appstream | python3-lib389 | 0 | 0:2.4.5-8.el9_4 |
| Red Hat:enterprise_linux:9::crb | 389-ds-base | 0 | 0:2.4.5-8.el9_4 |
| Red Hat:enterprise_linux:9::crb | 389-ds-base-debuginfo | 0 | 0:2.4.5-8.el9_4 |
| Red Hat:enterprise_linux:9::crb | 389-ds-base-debugsource | 0 | 0:2.4.5-8.el9_4 |
| Red Hat:enterprise_linux:9::crb | 389-ds-base-devel | 0 | 0:2.4.5-8.el9_4 |
| Red Hat:enterprise_linux:9::crb | 389-ds-base-libs | 0 | 0:2.4.5-8.el9_4 |
| Red Hat:enterprise_linux:9::crb | 389-ds-base-libs-debuginfo | 0 | 0:2.4.5-8.el9_4 |
| Red Hat:enterprise_linux:9::crb | 389-ds-base-snmp-debuginfo | 0 | 0:2.4.5-8.el9_4 |
| Red Hat:enterprise_linux:9::crb | python3-lib389 | 0 | 0:2.4.5-8.el9_4 |
| Red Hat:rhel_eus:8.8::appstream | 389-ds-base | 0 | 0:1.4.3.35-5.module+el8.8.0+22193+5f98570a |
| Red Hat:rhel_eus:8.8::appstream | 389-ds-base-debuginfo | 0 | 0:1.4.3.35-5.module+el8.8.0+22193+5f98570a |
| Red Hat:rhel_eus:8.8::appstream | 389-ds-base-debugsource | 0 | 0:1.4.3.35-5.module+el8.8.0+22193+5f98570a |
| Red Hat:rhel_eus:8.8::appstream | 389-ds-base-devel | 0 | 0:1.4.3.35-5.module+el8.8.0+22193+5f98570a |
| Red Hat:rhel_eus:8.8::appstream | 389-ds-base-legacy-tools | 0 | 0:1.4.3.35-5.module+el8.8.0+22193+5f98570a |
| Red Hat:rhel_eus:8.8::appstream | 389-ds-base-legacy-tools-debuginfo | 0 | 0:1.4.3.35-5.module+el8.8.0+22193+5f98570a |
| Red Hat:rhel_eus:8.8::appstream | 389-ds-base-libs | 0 | 0:1.4.3.35-5.module+el8.8.0+22193+5f98570a |
| Red Hat:rhel_eus:8.8::appstream | 389-ds-base-libs-debuginfo | 0 | 0:1.4.3.35-5.module+el8.8.0+22193+5f98570a |
| Red Hat:rhel_eus:8.8::appstream | 389-ds-base-snmp | 0 | 0:1.4.3.35-5.module+el8.8.0+22193+5f98570a |
| Red Hat:rhel_eus:8.8::appstream | 389-ds-base-snmp-debuginfo | 0 | 0:1.4.3.35-5.module+el8.8.0+22193+5f98570a |
| Red Hat:rhel_eus:8.8::appstream | python3-lib389 | 0 | 0:1.4.3.35-5.module+el8.8.0+22193+5f98570a |
| Red Hat:rhel_eus:9.2::appstream | 389-ds-base | 0 | 0:2.2.4-9.el9_2 |
| Red Hat:rhel_eus:9.2::appstream | 389-ds-base-debuginfo | 0 | 0:2.2.4-9.el9_2 |
| Red Hat:rhel_eus:9.2::appstream | 389-ds-base-debugsource | 0 | 0:2.2.4-9.el9_2 |
| Red Hat:rhel_eus:9.2::appstream | 389-ds-base-libs | 0 | 0:2.2.4-9.el9_2 |
| Red Hat:rhel_eus:9.2::appstream | 389-ds-base-libs-debuginfo | 0 | 0:2.2.4-9.el9_2 |
| Red Hat:rhel_eus:9.2::appstream | 389-ds-base-snmp-debuginfo | 0 | 0:2.2.4-9.el9_2 |
| Red Hat:rhel_eus:9.2::appstream | python3-lib389 | 0 | 0:2.2.4-9.el9_2 |
| Rocky Linux:8 | 389-ds-base | 0 | 0:1.4.3.39-7.module+el8.10.0+1832+2f5a9255 |
| Rocky Linux:9 | 389-ds-base | 0 | 0:2.4.5-8.el9_4 |
| SUSE:Enterprise Storage 7.1 | 389-ds | 0 | 1.4.4.20~git3.e7ac6d87-150300.3.35.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | 389-ds | 0 | 1.4.4.20~git3.e7ac6d87-150300.3.35.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | 389-ds | 0 | 2.0.20~git9.5e2d637c-150400.3.42.3 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | 389-ds | 0 | 2.0.20~git9.5e2d637c-150400.3.42.3 |
| SUSE:Linux Enterprise Module for Server Applications 15 SP5 | 389-ds | 0 | 2.2.10~git18.20ce9289-150500.3.24.1 |
| SUSE:Linux Enterprise Module for Server Applications 15 SP5 | 389-ds | 0 | 2.2.10~git2.345056d3-150500.3.21.1 |
| SUSE:Linux Enterprise Module for Server Applications 15 SP6 | 389-ds | 0 | 2.2.10~git18.20ce9289-150600.8.10.1 |
| SUSE:Linux Enterprise Module for Server Applications 15 SP6 | 389-ds | 0 | 2.2.10~git2.345056d3-150600.8.7.2 |
| SUSE:Linux Enterprise Server 15 SP3-LTSS | 389-ds | 0 | 1.4.4.20~git3.e7ac6d87-150300.3.35.1 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | 389-ds | 0 | 2.0.20~git9.5e2d637c-150400.3.42.3 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP3 | 389-ds | 0 | 1.4.4.20~git3.e7ac6d87-150300.3.35.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | 389-ds | 0 | 2.0.20~git9.5e2d637c-150400.3.42.3 |
| SUSE:Manager Proxy 4.3 | 389-ds | 0 | 2.0.20~git9.5e2d637c-150400.3.42.3 |
| SUSE:Manager Server 4.3 | 389-ds | 0 | 2.0.20~git9.5e2d637c-150400.3.42.3 |
| Ubuntu:20.04:LTS | 389-ds-base | 0 | No fix |
| Ubuntu:22.04:LTS | 389-ds-base | 0 | No fix |
| Ubuntu:24.04:LTS | 389-ds-base | 0 | No fix |
| Ubuntu:24.10 | 389-ds-base | 0 | No fix |
| Ubuntu:25.04 | 389-ds-base | 0 | No fix |
| Ubuntu:25.10 | 389-ds-base | 0 | No fix |
| Ubuntu:Pro:16.04:LTS | 389-ds-base | 0 | No fix |
| Ubuntu:Pro:18.04:LTS | 389-ds-base | 0 | No fix |
| Ubuntu:Pro:20.04:LTS | 389-ds-base | 0 | No fix |
| openSUSE:Leap 15.5 | 389-ds | 0 | 2.2.10~git18.20ce9289-150500.3.24.1 |
| openSUSE:Leap 15.5 | 389-ds | 0 | 2.2.10~git2.345056d3-150500.3.21.1 |
| openSUSE:Leap 15.6 | 389-ds | 0 | 2.2.10~git18.20ce9289-150600.8.10.1 |
| openSUSE:Leap 15.6 | 389-ds | 0 | 2.2.10~git2.345056d3-150600.8.7.2 |
| openSUSE:Tumbleweed | 389-ds | 0 | 3.1.1~git0.aef1668-1.1 |
Related vulnerabilities
- CVE-2024-5953 A denial of service vulnerability was found in the 389-ds-base LDAP server. Also affects 389-ds-base
- CVE-2024-3657 A flaw was found in 389-ds-base. Also affects 389-ds-base
- CVE-2024-1062 A heap overflow flaw was found in 389-ds-base. Also affects 389-ds-base
- CVE-2022-0996 A vulnerability was found in the 389 Directory Server that allows expired passwords to… Also affects 389-ds-base
- CVE-2021-4091 A double-free was found in the way 389-ds-base handles virtual attributes context in… Also affects 389-ds-base
- CVE-2024-6237 A flaw was found in the 389 Directory Server. Also affects 389-ds-base
- CVE-2024-8445 The fix for CVE-2024-2199 in 389-ds-base was insufficient to cover all scenarios. Also affects 389-ds-base
- CVE-2023-1055 A flaw was found in RHDS 11 and RHDS 12. Also affects 389-ds-base