7.5

CVE-2019-3883

In 389-ds-base up to version 1.4.1.2, requests are handled by workers threads. Each sockets will be waited by the worker for at most 'ioblocktimeout' seconds. However this timeout applies only for un-encrypted requests. Connections using SSL/TLS are not taking this timeout into account during reads, and may hang longer.An unauthenticated attacker could repeatedly create hanging LDAP requests to hang all the workers, resulting in a Denial of Service.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Fedoraproject ≫ 389 Directory Server Version <= 1.4.1.2
Debian ≫ Debian Linux Version8.0
Redhat ≫ Enterprise Linux Version6.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 8.43% 0.943
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:N/A:P
secalert@redhat.com 5.3 3.9 1.4
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE-772 Missing Release of Resource after Effective Lifetime

The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.

https://access.redhat.com/errata/RHSA-2019:3401
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1896
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3883
Third Party Advisory
Issue Tracking
https://lists.debian.org/debian-lts-announce/2019/05/msg00008.html
Third Party Advisory
Mailing List
https://lists.debian.org/debian-lts-announce/2023/04/msg00026.html
https://pagure.io/389-ds-base/issue/50329
Third Party Advisory
Issue Tracking
https://pagure.io/389-ds-base/pull-request/50331
Third Party Advisory