CVE-2024-2199 — 389-ds-base: malformed userpassword may cause crash at do_modify in slapd/modify.c

Description

A denial of service vulnerability was found in 389-ds-base ldap server. This issue may allow an authenticated user to cause a server crash while modifying `userPassword` using malformed input.

Affected products

Vendor	Product	Affected	Fixed
—	389-ds-base	< 3.1.1	3.1.1
Red Hat	Red Hat Directory Server 11.5 E4S for RHEL 8	—	—
Red Hat	Red Hat Directory Server 11.8 for RHEL 8	—	—
Red Hat	Red Hat Directory Server 11.9 for RHEL 8	—	—
Red Hat	Red Hat Directory Server 12.4 for RHEL 9	—	—
Red Hat	Red Hat Enterprise Linux 7	—	—
Red Hat	Red Hat Enterprise Linux 8	—	—
Red Hat	Red Hat Enterprise Linux 8.8 Extended Update Support	—	—
Red Hat	Red Hat Enterprise Linux 9	—	—
Red Hat	Red Hat Enterprise Linux 9.2 Extended Update Support	—	—
Red Hat	Red Hat Enterprise Linux 6	—	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 13	389-ds-base	3.1.1+dfsg1-1	—
Debian 12	389-ds-base	2.3.1+dfsg1-1+deb12u1	—
Debian 11	389-ds-base	1.4.4.11-2+deb11u1	DLA-4021-1

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 26.10	389-ds-base	No fix yet	—
Ubuntu 26.04 LTS	389-ds-base	No fix yet	—
Ubuntu 25.10	389-ds-base	No fix yet	—
Ubuntu 24.04 LTS	389-ds-base	No fix yet	—
Ubuntu 22.04 LTS	389-ds-base	No fix yet	—

Show 3 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu Pro 20.04 LTS	389-ds-base	No fix yet	—
Ubuntu Pro 18.04 LTS	389-ds-base	No fix yet	—
Ubuntu Pro 16.04 LTS	389-ds-base	No fix yet	—

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 9	389-ds-base +3	2.4.5-8.el9_4	RHSA-2024:3837
RHEL 8	389-ds-base +5	1.4.3.39-7.module+el8.10.0+21985+3665ccdb	RHSA-2024:4235
RHEL 7	389-ds-base +3	1.3.11.1-5.el7_9	RHSA-2024:3591

Show 5 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
RHEL 9.2 EUS	389-ds-base +2	2.2.4-9.el9_2	RHSA-2024:4633
RHEL 8.8 EUS	389-ds-base +5	1.4.3.35-5.module+el8.8.0+22193+5f98570a	RHSA-2024:5690
Red Hat Directory Server E4s 11	389-ds-base +6	1.4.3.34-4.module+el8dsrv+22781+5fe99dde	RHSA-2025:1632
Red Hat Directory Server 12	389-ds-base +5	2.4.5-4.module+el9dsrv+21964+c7e95493	RHSA-2024:4092
Red Hat Directory Server 11	389-ds-base +6	1.4.3.37-10.module+el8dsrv+21971+f7435891	RHSA-2024:4210, RHSA-2024:4209

AlmaLinux

Errata ↗

Release	Package	Fixed in	Advisory
AlmaLinux 9	389-ds-base +3	2.4.5-8.el9_4	ALSA-2024:3837
AlmaLinux 8	389-ds-base +5	1.4.3.39-7.module_el8.10.0+3864+d8eec553	ALSA-2024:4235

Rocky Linux

Errata ↗

Release	Package	Fixed in	Advisory
Rocky Linux 9	389-ds-base	2.4.5-8.el9_4	RLSA-2024:3837
Rocky Linux 8	389-ds-base	1.4.3.39-7.module+el8.10.0+1832+2f5a9255	RLSA-2024:4235

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 15 SP6	389-ds	2.2.10~git2.345056d3-150600.8.7.2	SUSE-SU-2024:3844-1, SUSE-SU-2024:2910-1
SLES 15 SP5	389-ds	2.2.10~git2.345056d3-150500.3.21.1	SUSE-SU-2024:3843-1, SUSE-SU-2024:3082-1
SLES 15 SP4	389-ds	2.0.20~git9.5e2d637c-150400.3.42.3	SUSE-SU-2024:3218-1
SLES 15 SP3	389-ds	1.4.4.20~git3.e7ac6d87-150300.3.35.1	SUSE-SU-2024:3257-1

Show 7 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLES for SAP 15 SP4	389-ds	2.0.20~git9.5e2d637c-150400.3.42.3	SUSE-SU-2024:3218-1
SLES for SAP 15 SP3	389-ds	1.4.4.20~git3.e7ac6d87-150300.3.35.1	SUSE-SU-2024:3257-1
SLE HPC 15 SP4	389-ds	2.0.20~git9.5e2d637c-150400.3.42.3	SUSE-SU-2024:3218-1
SLE HPC 15 SP3	389-ds	1.4.4.20~git3.e7ac6d87-150300.3.35.1	SUSE-SU-2024:3257-1
SUSE Manager Server 4.3	389-ds	2.0.20~git9.5e2d637c-150400.3.42.3	SUSE-SU-2024:3218-1
SUSE Manager Proxy 4.3	389-ds	2.0.20~git9.5e2d637c-150400.3.42.3	SUSE-SU-2024:3218-1
SUSE Enterprise Storage 7.1	389-ds	1.4.4.20~git3.e7ac6d87-150300.3.35.1	SUSE-SU-2024:3257-1

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Tumbleweed	389-ds	3.1.1~git0.aef1668-1.1	openSUSE-SU-2024:14227-1
openSUSE Leap 15.6	389-ds	2.2.10~git2.345056d3-150600.8.7.2	SUSE-SU-2024:3844-1, SUSE-SU-2024:2910-1
openSUSE Leap 15.5	389-ds	2.2.10~git2.345056d3-150500.3.21.1	SUSE-SU-2024:3843-1, SUSE-SU-2024:3082-1

Amazon Linux

Release	Package	Fixed in	Advisory
Amazon Linux 2	389-ds-base +3	1.3.10.2-17.amzn2.0.2	ALAS2-2025-2798

Oracle Linux

Release	Package	Fixed in	Advisory
Oracle Linux 9	389-ds-base +3	2.4.5-8.el9_4	ELSA-2024-3837
Oracle Linux 8	389-ds-base +5	1.4.3.39-7.module+el8.10.0+90358+1275b17f	ELSA-2024-4235
Oracle Linux 7	389-ds-base +3	1.3.11.1-5.el7_9	ELSA-2024-3591

Advisories 26

ALSA-2024:3837 Important: 389-ds-base security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2024:4235 Important: 389-ds security update AlmaLinux Security Advisories · Oct 29, 2026
RHSA-2025:1632 Red Hat Security Advisory: redhat-ds:11 security update Red Hat Security Advisories (RHSA) · Sep 9, 2026
RHSA-2024:4633 Red Hat Security Advisory: 389-ds-base security update Red Hat Security Advisories (RHSA) · Sep 9, 2026
RHSA-2024:5690 Red Hat Security Advisory: 389-ds:1.4 security update Red Hat Security Advisories (RHSA) · Sep 9, 2026
RHSA-2024:4235 Red Hat Security Advisory: 389-ds security update Red Hat Security Advisories (RHSA) · Sep 9, 2026
RHSA-2024:4209 Red Hat Security Advisory: redhat-ds:11 security and bug fix update Red Hat Security Advisories (RHSA) · Sep 9, 2026
RHSA-2024:4210 Red Hat Security Advisory: redhat-ds:11 security update Red Hat Security Advisories (RHSA) · Sep 9, 2026
RHSA-2024:4092 Red Hat Security Advisory: redhat-ds:12 security, bug fix update Red Hat Security Advisories (RHSA) · Sep 9, 2026
RHSA-2024:3837 Red Hat Security Advisory: 389-ds-base security update Red Hat Security Advisories (RHSA) · Sep 9, 2026
RHSA-2024:3591 Red Hat Security Advisory: 389-ds-base security update Red Hat Security Advisories (RHSA) · Sep 9, 2026
DLA-4021-1 389-ds-base - security update Debian Security (DSA / DLA) · Mar 9, 2026
RLSA-2024:3837 Important: 389-ds-base security update Rocky Linux Security Advisories · Feb 4, 2026
RLSA-2024:4235 Important: 389-ds security update Rocky Linux Security Advisories · Feb 4, 2026
SUSE-SU-2024:3218-1 Security update for 389-ds SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2024:2910-1 Security update for 389-ds SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2024:3257-1 Security update for 389-ds SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2024:14227-1 389-ds-3.1.1~git0.aef1668-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2024:3844-1 Security update for 389-ds SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2024:3082-1 Security update for 389-ds SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2024:3843-1 Security update for 389-ds SUSE / openSUSE Security Updates · Feb 4, 2026
WID-SEC-2024-1290 Red Hat Enterprise Linux: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Dec 16, 2025
ALAS2-2025-2798 Moderate: 389-ds-base security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Mar 25, 2025
ELSA-2024-4235 Important: 389-ds security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jul 3, 2024
ELSA-2024-3837 Important: 389-ds-base security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jun 12, 2024
ELSA-2024-3591 Important: 389-ds-base security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jun 4, 2024

References

RHSA-2024:3591 vendor-advisory
RHSA-2024:3837 vendor-advisory
RHSA-2024:4092 vendor-advisory
RHSA-2024:4209 vendor-advisory
RHSA-2024:4210 vendor-advisory
RHSA-2024:4235 vendor-advisory
RHSA-2024:4633 vendor-advisory
RHSA-2024:5690 vendor-advisory
RHSA-2025:1632 vendor-advisory
https://access.redhat.com/security/cve/CVE-2024-2199 vdb-entry
RHBZ#2267976 issue-tracking
https://www.port389.org/docs/389ds/releases/release-3-1-1.html

CNA	v3.1	5.7
EUVD	v3.1	5.7