CVE-2024-6237

Description

A flaw was found in the 389 Directory Server. This flaw allows an unauthenticated user to cause a systematic server crash while sending a specific extended search request, leading to a denial of service.

Reserved 2024-06-21 | Published 2024-07-09 | Updated 2024-11-24 | Assigner redhat

Problem types

Improper Handling of Missing Values

Product status

Default status
unaffected

Any version before 2.4.5
affected

Default status
affected

9040020240723122852.1674d574 before *
unaffected

Default status
affected

0:2.4.5-9.el9_4 before *
unaffected

Default status
unaffected

Default status
unaffected

Default status
unaffected

Default status
unaffected

Timeline

2024-06-20:	Reported to Red Hat.
2024-07-09:	Made public.

References

access.redhat.com/errata/RHSA-2024:4997 (RHSA-2024:4997) vendor-advisory

access.redhat.com/errata/RHSA-2024:5192 (RHSA-2024:5192) vendor-advisory

access.redhat.com/security/cve/CVE-2024-6237 vdb-entry

bugzilla.redhat.com/show_bug.cgi?id=2293579 (RHBZ#2293579) issue-tracking

github.com/389ds/389-ds-base/issues/5989

cve.org (CVE-2024-6237)

nvd.nist.gov (CVE-2024-6237)

Download JSON