Description
A heap overflow flaw was found in 389-ds-base. This issue leads to a denial of service when writing a value larger than 256 chars in log_entry_attr.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | 389-ds-base | 1.4.3.0 – < 2.2.* | 2.2.* |
| Red Hat | Red Hat Directory Server 11.5 E4S for RHEL 8 | — | — |
| Red Hat | Red Hat Directory Server 11.7 for RHEL 8 | — | — |
| Red Hat | Red Hat Directory Server 11.8 for RHEL 8 | — | — |
| Red Hat | Red Hat Directory Server 12.2 EUS for RHEL 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 9.2 Extended Update Support | — | — |
| Red Hat | Red Hat Directory Server 12 | — | — |
| Red Hat | Red Hat Enterprise Linux 6 | — | — |
| Red Hat | Red Hat Enterprise Linux 7 | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 13 | 389-ds-base | 2.3.4+dfsg1-1 | — |
| Debian 12 | 389-ds-base | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | 389-ds-base | No fix yet | — |
| Ubuntu 26.04 LTS | 389-ds-base | No fix yet | — |
| Ubuntu 25.10 | 389-ds-base | No fix yet | — |
| Ubuntu 24.04 LTS | 389-ds-base | No fix yet | — |
| Ubuntu 22.04 LTS | 389-ds-base | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | 389-ds-base | No fix yet | — |
| Ubuntu Pro 18.04 LTS | 389-ds-base | No fix yet | — |
| Ubuntu Pro 16.04 LTS | 389-ds-base | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | 389-ds-base +5 | 1.4.3.39-3.module+el8.10.0+21535+f663b039 | RHSA-2024:3047 |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.2 EUS | 389-ds-base +2 | 2.2.4-9.el9_2 | RHSA-2024:4633 |
| RHEL 8.8 EUS | 389-ds-base +5 | 1.4.3.35-5.module+el8.8.0+22193+5f98570a | RHSA-2024:5690 |
| RHEL 8.6 EUS | 389-ds-base +5 | 1.4.3.34-6.module+el8.6.0+21315+7f417418 | RHSA-2024:1074 |
| Red Hat Directory Server Eus 12 | 389-ds-base +5 | 2.2.7-6.module+el9dsrv+22320+37c894f3 | RHSA-2024:7458 |
| Red Hat Directory Server E4s 11 | 389-ds-base +6 | 1.4.3.34-4.module+el8dsrv+22781+5fe99dde | RHSA-2025:1632 |
| Red Hat Directory Server 11 | 389-ds-base +6 | 1.4.3.34-3.module+el8dsrv+21391+b62d2223 | RHSA-2024:4209, RHSA-2024:1372 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | 389-ds-base +5 | 1.4.3.39-3.module_el8.10.0+3829+ea459e35 | ALSA-2024:3047 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | 389-ds-base | 1.4.3.39-3.module+el8.10.0+1754+15117a6d | RLSA-2024:3047 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP6 | 389-ds | 2.2.8~git65.347aae6-150600.8.3.1 | SUSE-SU-2024:1906-1 |
| SLES 15 SP5 | 389-ds | 2.2.8~git65.347aae6-150500.3.17.1 | SUSE-SU-2024:0908-1 |
| SLES 15 SP4 | 389-ds | 2.0.20~git9.5e2d637c-150400.3.42.3 | SUSE-SU-2024:3218-1 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP4 | 389-ds | 2.0.20~git9.5e2d637c-150400.3.42.3 | SUSE-SU-2024:3218-1 |
| SLE HPC 15 SP4 | 389-ds | 2.0.20~git9.5e2d637c-150400.3.42.3 | SUSE-SU-2024:3218-1 |
| SUSE Manager Server 4.3 | 389-ds | 2.0.20~git9.5e2d637c-150400.3.42.3 | SUSE-SU-2024:3218-1 |
| SUSE Manager Proxy 4.3 | 389-ds | 2.0.20~git9.5e2d637c-150400.3.42.3 | SUSE-SU-2024:3218-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.6 | 389-ds | 2.2.8~git65.347aae6-150600.8.3.1 | SUSE-SU-2024:1906-1 |
| openSUSE Leap 15.5 | 389-ds | 2.2.8~git65.347aae6-150500.3.17.1 | SUSE-SU-2024:0908-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | 389-ds-base +5 | 1.4.3.39-3.module+el8.10.0+90328+4f014c15 | ELSA-2024-3047 |
Advisories 15
- ALSA-2024:3047 Moderate: 389-ds:1.4 security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2025:1632 Red Hat Security Advisory: redhat-ds:11 security update Red Hat Security Advisories (RHSA) · Sep 9, 2026
- RHSA-2024:7458 Red Hat Security Advisory: redhat-ds:12 security update Red Hat Security Advisories (RHSA) · Sep 9, 2026
- RHSA-2024:5690 Red Hat Security Advisory: 389-ds:1.4 security update Red Hat Security Advisories (RHSA) · Sep 9, 2026
- RHSA-2024:4633 Red Hat Security Advisory: 389-ds-base security update Red Hat Security Advisories (RHSA) · Sep 9, 2026
- RHSA-2024:4209 Red Hat Security Advisory: redhat-ds:11 security and bug fix update Red Hat Security Advisories (RHSA) · Sep 9, 2026
- RHSA-2024:3047 Red Hat Security Advisory: 389-ds:1.4 security update Red Hat Security Advisories (RHSA) · Apr 21, 2026
- RHSA-2024:1074 Red Hat Security Advisory: 389-ds:1.4 security update Red Hat Security Advisories (RHSA) · Apr 21, 2026
- RHSA-2024:1372 Red Hat Security Advisory: redhat-ds:11 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Feb 26, 2026
- RLSA-2024:3047 Moderate: 389-ds:1.4 security update Rocky Linux Security Advisories · Feb 5, 2026
- SUSE-SU-2024:3218-1 Security update for 389-ds SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:0908-1 Security update for 389-ds SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:1906-1 Security update for 389-ds SUSE / openSUSE Security Updates · May 2, 2025
- WID-SEC-2024-0547 Red Hat Enterprise Linux und Directory Server: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Feb 17, 2025
- ELSA-2024-3047 Moderate: 389-ds:1.4 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · May 24, 2024
References
- RHSA-2024:1074 vendor-advisory
- RHSA-2024:1372 vendor-advisory
- RHSA-2024:3047 vendor-advisory
- RHSA-2024:4209 vendor-advisory
- RHSA-2024:4633 vendor-advisory
- RHSA-2024:5690 vendor-advisory
- RHSA-2024:7458 vendor-advisory
- RHSA-2025:1632 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2024-1062 vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=2256711
- RHBZ#2261879 issue-tracking