{"api_version":"1","generated_at":"2026-07-24T23:41:30+00:00","cve":"CVE-2019-3883","urls":{"html":"https://cve.report/CVE-2019-3883","api":"https://cve.report/api/cve/CVE-2019-3883.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2019-3883","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2019-3883"},"summary":{"title":"CVE-2019-3883","description":"In 389-ds-base up to version 1.4.1.2, requests are handled by workers threads. Each sockets will be waited by the worker for at most 'ioblocktimeout' seconds. However this timeout applies only for un-encrypted requests. Connections using SSL/TLS are not taking this timeout into account during reads, and may hang longer.An unauthenticated attacker could repeatedly create hanging LDAP requests to hang all the workers, resulting in a Denial of Service.","state":"PUBLIC","assigner":"secalert@redhat.com","published_at":"2019-04-17 14:29:00","updated_at":"2023-04-24 09:15:00"},"problem_types":["CWE-772"],"metrics":[],"references":[{"url":"https://access.redhat.com/errata/RHSA-2019:1896","name":"RHSA-2019:1896","refsource":"REDHAT","tags":["Third Party Advisory"],"title":"Red Hat Customer Portal","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://lists.debian.org/debian-lts-announce/2023/04/msg00026.html","name":"[debian-lts-announce] 20230424 [SECURITY] [DLA 3399-1] 389-ds-base security update","refsource":"MLIST","tags":[],"title":"[SECURITY] [DLA 3399-1] 389-ds-base security update","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://lists.debian.org/debian-lts-announce/2019/05/msg00008.html","name":"[debian-lts-announce] 20190506 [SECURITY] [DLA 1779-1] 389-ds-base security update","refsource":"MLIST","tags":["Mailing List","Third Party Advisory"],"title":"[SECURITY] [DLA 1779-1] 389-ds-base security update","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3883","name":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3883","refsource":"CONFIRM","tags":["Issue Tracking","Third Party Advisory"],"title":"1693612 – (CVE-2019-3883) CVE-2019-3883 389-ds-base: DoS via hanging secured connections","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://pagure.io/389-ds-base/pull-request/50331","name":"https://pagure.io/389-ds-base/pull-request/50331","refsource":"CONFIRM","tags":["Third Party Advisory"],"title":"PR#50331: Ticket 50309 - Possible Security Issue: DOS due to ioblocktimeout not applying to TLS - 389-ds-base\n - Pagure.io","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://pagure.io/389-ds-base/issue/50329","name":"https://pagure.io/389-ds-base/issue/50329","refsource":"CONFIRM","tags":["Issue Tracking","Third Party Advisory"],"title":"Issue #50329: Possible Security Issue: DOS due to ioblocktimeout not applying to TLS - 389-ds-base - Pagure.io","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://access.redhat.com/errata/RHSA-2019:3401","name":"RHSA-2019:3401","refsource":"REDHAT","tags":["Third Party Advisory"],"title":"Red Hat Customer Portal","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-3883","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-3883","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2019","cve_id":"3883","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"debian","cpe5":"debian_linux","cpe6":"8.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"3883","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"debian","cpe5":"debian_linux","cpe6":"8.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"3883","vulnerable":"1","versionEndIncluding":"1.4.1.2","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"fedoraproject","cpe5":"389_directory_server","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"3883","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"redhat","cpe5":"enterprise_linux","cpe6":"6.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"3883","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"redhat","cpe5":"enterprise_linux","cpe6":"6.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2019-3883","qid":"159651","title":"Oracle Enterprise Linux Security Update for 389-ds:1.4 (ELSA-2019-3401)"},{"cve":"CVE-2019-3883","qid":"181751","title":"Debian Security Update for 389-ds-base (DLA 3399-1)"},{"cve":"CVE-2019-3883","qid":"377513","title":"Alibaba Cloud Linux Security Update for 389-ds-base (ALINUX2-SA-2019:0046)"}]},"source_records":{"cve_program":{"data_type":"CVE","data_format":"MITRE","data_version":"4.0","CVE_data_meta":{"ID":"CVE-2019-3883","ASSIGNER":"secalert@redhat.com","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"vendor_name":"Red Hat","product":{"product_data":[{"product_name":"389-ds-base","version":{"version_data":[{"version_value":"affects up to 1.4.1.2"}]}}]}}]}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-772"}]}]},"references":{"reference_data":[{"refsource":"MLIST","name":"[debian-lts-announce] 20190506 [SECURITY] [DLA 1779-1] 389-ds-base security update","url":"https://lists.debian.org/debian-lts-announce/2019/05/msg00008.html"},{"refsource":"REDHAT","name":"RHSA-2019:1896","url":"https://access.redhat.com/errata/RHSA-2019:1896"},{"refsource":"REDHAT","name":"RHSA-2019:3401","url":"https://access.redhat.com/errata/RHSA-2019:3401"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3883","name":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3883","refsource":"CONFIRM"},{"url":"https://pagure.io/389-ds-base/issue/50329","name":"https://pagure.io/389-ds-base/issue/50329","refsource":"CONFIRM"},{"url":"https://pagure.io/389-ds-base/pull-request/50331","name":"https://pagure.io/389-ds-base/pull-request/50331","refsource":"CONFIRM"},{"refsource":"MLIST","name":"[debian-lts-announce] 20230424 [SECURITY] [DLA 3399-1] 389-ds-base security update","url":"https://lists.debian.org/debian-lts-announce/2023/04/msg00026.html"}]},"description":{"description_data":[{"lang":"eng","value":"In 389-ds-base up to version 1.4.1.2, requests are handled by workers threads. Each sockets will be waited by the worker for at most 'ioblocktimeout' seconds. However this timeout applies only for un-encrypted requests. Connections using SSL/TLS are not taking this timeout into account during reads, and may hang longer.An unauthenticated attacker could repeatedly create hanging LDAP requests to hang all the workers, resulting in a Denial of Service."}]},"impact":{"cvss":[[{"vectorString":"5.3/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.0"}]]}},"nvd":{"publishedDate":"2019-04-17 14:29:00","lastModifiedDate":"2023-04-24 09:15:00","problem_types":["CWE-772"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:N/A:P","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"PARTIAL","baseScore":5},"severity":"MEDIUM","exploitabilityScore":10,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:fedoraproject:389_directory_server:*:*:*:*:*:*:*:*","versionEndIncluding":"1.4.1.2","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2019","CveId":"3883","Ordinal":"141492","Title":"CVE-2019-3883","CVE":"CVE-2019-3883","Year":"2019"},"notes":[{"CveYear":"2019","CveId":"3883","Ordinal":"1","NoteData":"In 389-ds-base up to version 1.4.1.2, requests are handled by workers threads. Each sockets will be waited by the worker for at most 'ioblocktimeout' seconds. However this timeout applies only for un-encrypted requests. Connections using SSL/TLS are not taking this timeout into account during reads, and may hang longer.An unauthenticated attacker could repeatedly create hanging LDAP requests to hang all the workers, resulting in a Denial of Service.","Type":"Description","Title":null},{"CveYear":"2019","CveId":"3883","Ordinal":"2","NoteData":"2019-04-17","Type":"Other","Title":"Published"},{"CveYear":"2019","CveId":"3883","Ordinal":"3","NoteData":"2020-11-13","Type":"Other","Title":"Modified"}]}}}