389-ds-base: a heap overflow leading to denail-of-servce while writing a value larger than 256 chars (in log_entry_attr)
Summary
| CVE | CVE-2024-1062 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2024-02-12 13:15:09 UTC |
| Updated | 2026-11-05 12:17:46 UTC |
| Description | A heap overflow flaw was found in 389-ds-base. This issue leads to a denial of service when writing a value larger than 256 chars in log_entry_attr. |
Risk And Classification
Primary CVSS: v3.1 5.5 MEDIUM from [email protected]
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Problem Types: CWE-122 | CWE-122 Heap-based Buffer Overflow
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 5.5 | MEDIUM | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| 3.1 | CNA | CVSS | 5.5 | MEDIUM | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
CVSS v3.1 Breakdown
Attack Vector
LocalAttack Complexity
LowPrivileges Required
LowUser Interaction
NoneScope
UnchangedConfidentiality
NoneIntegrity
NoneAvailability
HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD Known Affected Configurations (CPE 2.3)
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Red Hat | Red Hat Directory Server 11.5 E4S For RHEL 8 | unaffected 8060020250210084424.0ca98e7e * rpm | Not specified |
| CNA | Red Hat | Red Hat Directory Server 11.7 For RHEL 8 | unaffected 8080020240306153507.f969626e * rpm | Not specified |
| CNA | Red Hat | Red Hat Directory Server 11.8 For RHEL 8 | unaffected 8090020240606122459.91529cd0 * rpm | Not specified |
| CNA | Red Hat | Red Hat Directory Server 12.2 EUS For RHEL 9 | unaffected 9020020240916150035.1674d574 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8 | unaffected 8100020240315011748.945b6f6d * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support | unaffected 8060020240213164457.824efc52 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8.8 Extended Update Support | unaffected 8080020240807050952.6dbb3803 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 9.2 Extended Update Support | unaffected 0:2.2.4-9.el9_2 * rpm | Not specified |
| CNA | Red Hat | Red Hat Directory Server 12 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 6 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 7 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 9 | Not specified | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| access.redhat.com/errata/RHSA-2025:1632 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2024:5690 | [email protected] | access.redhat.com | Vendor Advisory |
| access.redhat.com/errata/RHSA-2024:1074 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | Vendor Advisory |
| access.redhat.com/errata/RHSA-2024:4633 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | Vendor Advisory |
| bugzilla.redhat.com/show_bug.cgi | af854a3a-2127-422b-91ae-364da2661108 | bugzilla.redhat.com | Issue Tracking, Vendor Advisory |
| bugzilla.redhat.com/show_bug.cgi | af854a3a-2127-422b-91ae-364da2661108 | bugzilla.redhat.com | Issue Tracking, Vendor Advisory |
| access.redhat.com/errata/RHSA-2024:3047 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | Vendor Advisory |
| access.redhat.com/security/cve/CVE-2024-1062 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | Vendor Advisory |
| access.redhat.com/errata/RHSA-2024:4209 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | Vendor Advisory |
| access.redhat.com/errata/RHSA-2024:1372 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | Vendor Advisory |
| access.redhat.com/errata/RHSA-2024:7458 | [email protected] | access.redhat.com | Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2024-01-30T00:00:00.000Z | Reported to Red Hat. |
| CNA | 2024-01-30T00:00:00.000Z | Made public. |
Workarounds
CNA: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.