3D
Product
389 Directory Server
39
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 13Medium 5Low 1
Watch
Add 389 Directory Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2017-7551 | 9.8 | Aug 16 | 389-ds-base version before 1.3.5.19 and 1.3.6.7 are vulnerable to password brute-force attacks during account lockout due to different return codes returned on password attempts Affected: 1.3.5.19; 1.3.6.7 |
| CVE-2017-15135 | 8.1 | Jan 24 | It was found that 389-ds-base since 1.3.6.1 up to and including 1.4.0.3 did not always handle internal hash comparison operations correctly during the authentication process Affected: 1.3.6.1 through 1.4.0.3 |
| CVE-2019-10171 | 7.5 | Aug 2 | It was found that the fix for CVE-2018-14648 in 389-ds-base, versions 1.4.0.x before 1.4.0.17, was incorrectly applied in RHEL 7.5 Affected: 1.4.0.0 before 1.4.0.17 |
| CVE-2019-3883 | 7.5 | Apr 17 | In 389-ds-base up to version 1.4.1.2, requests are handled by workers threads Affected: through 1.4.1.2 |
| CVE-2018-14648 | 7.5 | Sep 28 | A flaw was found in 389 Directory Server Affected: before 1.4.0.17 |
| CVE-2018-14638 | 7.5 | Sep 14 | A flaw was found in 389-ds-base before version 1.3.8.4-13 Affected: before 1.3.8.4 |
| CVE-2018-14624 | 7.5 | Sep 6 | A vulnerability was discovered in 389-ds-base through versions 1.3.7.10, 1.3.8.8 and 1.4.0.16 Affected: through 1.3.7.10; 1.3.8.0 through 1.3.8.8; 1.4.0.0 through 1.4.0.16 |
| CVE-2018-1089 | 7.5 | May 9 | 389-ds-base before versions 1.4.0.9, 1.3.8.1, 1.3.6.15 did not properly handle long search filters with characters needing escapes, possibly leading to buffer overflows Affected: 1.3.6.0 before 1.3.6.15; 1.4.0.0 before 1.4.0.9; 1.3.8.1; 1.3.8.2 |
| CVE-2017-2591 | 7.5 | Apr 30 | 389-ds-base before version 1.3.6 is vulnerable to an improperly NULL terminated array in the uniqueness_entry_to_config() function in the "attribute uniqueness" plugin of 389… Affected: before 1.3.6 |
| CVE-2018-1054 | 7.5 | Mar 7 | An out-of-bounds memory read flaw was found in the way 389-ds-base handled certain LDAP search filters, affecting all versions including 1.4.x Affected: through 1.4.0.6 |
| CVE-2017-15134 | 7.5 | Mar 1 | A stack buffer overflow flaw was found in the way 389-ds-base 1.3.6.x before 1.3.6.13, 1.3.7.x before 1.3.7.9, 1.4.x before 1.4.0.5 handled certain LDAP search filters Affected: 1.3.6.1 before 1.3.6.13; 1.3.7.1 before 1.3.7.9; 1.4.0.0 before 1.4.0.5 |
| CVE-2015-1854 | 7.5 | Sep 19 | 389 Directory Server before 1.3.3.10 allows attackers to bypass intended access restrictions and modify directory entries via a crafted ldapmodrdn call Affected: through 1.3.3.9 |
| CVE-2016-0741 | 7.5 | Apr 19 | slapd/connection.c in 389 Directory Server (formerly Fedora Directory Server) 1.3.4.x before 1.3.4.7 allows remote attackers to cause a denial of service (infinite loop and… Affected: 1.3.4.0; 1.3.4.1; 1.3.4.4; 1.3.4.5 |
| CVE-2018-10871 | 7.2 | Jul 18 | 389-ds-base before versions 1.3.8.5, 1.4.0.12 is vulnerable to a Cleartext Storage of Sensitive Information Affected: before 1.3.8.5; 1.4.0.0 before 1.4.0.12 |
| CVE-2019-14824 | 6.5 | Nov 8 | A flaw was found in the 'deref' plugin of 389-ds-base where it could use the 'search' permission to display attribute values Affected: All versions, or not specified |
| CVE-2017-2668 | 6.5 | Jun 22 | 389-ds-base before versions 1.3.5.17 and 1.3.6.10 is vulnerable to an invalid pointer dereference in the way LDAP bind requests are handled Affected: 1.3.5.0 before 1.3.5.17; 1.3.6.0 before 1.3.6.10 |
| CVE-2018-10850 | 5.9 | Jun 13 | 389-ds-base before versions 1.4.0.10, 1.3.8.3 is vulnerable to a race condition in the way 389-ds-base handles persistent search, resulting in a crash if the server is under load Affected: before 1.4.0.10 |
| CVE-2011-0704 | 5.9 | May 4 | 389 Directory Server 1.2.7.5, when built with mozldap, allows remote attackers to cause a denial of service (replica crash) by sending an empty modify request Affected: 1.2.7.5 |
| CVE-2019-10224 | 4.6 | Nov 25 | A flaw has been found in 389-ds-base versions 1.4.x.x before 1.4.1.3 Affected: 1.4.0.0 before 1.4.1.3 |
| CVE-2010-3282 | 3.3 | Jan 9 | 389 Directory Server before 1.2.7.1 (aka Red Hat Directory Server 8.2) and HP-UX Directory Server before B.08.10.03, when audit logging is enabled, logs the Directory Manager… Affected: before 1.2.7.1 |
| CVE-2015-3230 | – | Oct 29 | 389 Directory Server (formerly Fedora Directory Server) before 1.3.3.12 does not enforce the nsSSL3Ciphers preference when creating an sslSocket, which allows remote attackers to… Affected: through 1.3.3.10 |
| CVE-2014-8112 | – | Mar 10 | 389 Directory Server 1.3.1.x, 1.3.2.x before 1.3.2.27, and 1.3.3.x before 1.3.3.9 stores "unhashed" passwords even when the nsslapd-unhashed-pw-switch option is set to off, which… Affected: 1.3.1.0; 1.3.1.1; 1.3.1.2; 1.3.1.3; 1.3.1.4; 1.3.1.5; +34 more |
| CVE-2014-8105 | – | Mar 10 | 389 Directory Server before 1.3.2.27 and 1.3.3.x before 1.3.3.9 does not properly restrict access to the "cn=changelog" LDAP sub-tree, which allows remote attackers to obtain… Affected: through 1.3.2.26; 1.3.3.0; 1.3.3.2; 1.3.3.3; 1.3.3.5; 1.3.3.8 |
| CVE-2014-3562 | – | Aug 21 | Red Hat Directory Server 8 and 389 Directory Server, when debugging is enabled, allows remote attackers to obtain sensitive replicated metadata by searching the directory Affected: 1.2.1; 1.2.2; 1.2.3; 1.2.5; 1.2.5; 1.2.5; +34 more |
| CVE-2014-0132 | – | Mar 18 | The SASL authentication functionality in 389 Directory Server before 1.2.11.26 allows remote authenticated users to connect as an arbitrary user and gain privileges via the… Affected: through 1.2.11.25; 1.2.11.1; 1.2.11.5; 1.2.11.6; 1.2.11.8; 1.2.11.9; +12 more |
| CVE-2013-4485 | – | Nov 23 | 389 Directory Server 1.2.11.15 (aka Red Hat Directory Server before 8.2.11-14) allows remote authenticated users to cause a denial of service (crash) via multiple @ characters in… Affected: 1.2.11.15 |
| CVE-2013-4283 | – | Sep 10 | ns-slapd in 389 Directory Server before 1.3.0.8 allows remote attackers to cause a denial of service (server crash) via a crafted Distinguished Name (DN) in a MOD operation… Affected: through 1.3.0.7; 1.3.0.2; 1.3.0.3; 1.3.0.4; 1.3.0.5; 1.3.0.6 |
| CVE-2013-2219 | – | Jul 31 | The Red Hat Directory Server before 8.2.11-13 and 389 Directory Server do not properly restrict access to entity attributes, which allows remote authenticated users to obtain… Affected: All versions, or not specified |
| CVE-2013-1897 | – | May 13 | The do_search function in ldap/servers/slapd/search.c in 389 Directory Server 1.2.x before 1.2.11.20 and 1.3.x before 1.3.0.5 does not properly restrict access to entries when the… Affected: 1.2.1; 1.2.2; 1.2.3; 1.2.5; 1.2.5; 1.2.5; +34 more |
| CVE-2013-0312 | – | Mar 13 | 389 Directory Server before 1.3.0.4 allows remote attackers to cause a denial of service (crash) via a zero length LDAP control sequence Affected: through 1.3.0.3 |
| CVE-2012-4450 | – | Oct 1 | 389 Directory Server 1.2.10 does not properly update the ACL when a DN entry is moved by a modrdn operation, which allows remote authenticated users with certain permissions to… Affected: 1.2.10 |
| CVE-2012-2746 | – | Jul 3 | 389 Directory Server before 1.2.11.6 (aka Red Hat Directory Server before 8.2.10-3), when the password of a LDAP user has been changed and audit logging is enabled, saves the new… Affected: through 1.2.11.5; 1.2.1; 1.2.2; 1.2.3; 1.2.5; 1.2.5; +32 more |
| CVE-2012-2678 | – | Jul 3 | 389 Directory Server before 1.2.11.6 (aka Red Hat Directory Server before 8.2.10-3), after the password for a LDAP user has been changed and before the server has been reset,… Affected: through 1.2.11.5; 1.2.1; 1.2.2; 1.2.3; 1.2.5; 1.2.5; +32 more |
| CVE-2012-0833 | – | Jul 3 | The acllas__handle_group_entry function in servers/plugins/acl/acllas.c in 389 Directory Server before 1.2.10 does not properly handled access control instructions (ACIs) that use… Affected: through 1.2.10; 1.2.1; 1.2.2; 1.2.3; 1.2.5; 1.2.5; +25 more |
| CVE-2011-1067 | – | Feb 23 | slapd (aka ns-slapd) in 389 Directory Server before 1.2.8.a2 does not properly manage the c_timelimit field of the connection table element, which allows remote attackers to cause… Affected: through 1.2.8; 1.2.1; 1.2.2; 1.2.3; 1.2.5; 1.2.5; +15 more |
| CVE-2011-0532 | – | Feb 23 | The (1) backup and restore scripts, (2) main initialization script, and (3) ldap-agent script in 389 Directory Server 1.2.x (aka Red Hat Directory Server 8.2.x) place a… Affected: 1.2.1; 1.2.2; 1.2.3; 1.2.5; 1.2.5; 1.2.5; +16 more |
| CVE-2011-0022 | – | Feb 23 | The setup scripts in 389 Directory Server 1.2.x (aka Red Hat Directory Server 8.2.x), when multiple unprivileged instances are configured, use 0777 permissions for the… Affected: 1.2.1; 1.2.2; 1.2.3; 1.2.5; 1.2.5; 1.2.5; +16 more |
| CVE-2011-0019 | – | Feb 23 | slapd (aka ns-slapd) in 389 Directory Server 1.2.7.5 (aka Red Hat Directory Server 8.2.x or dirsrv) does not properly handle simple paged result searches, which allows remote… Affected: 1.2.7.5 |
| CVE-2010-4746 | – | Feb 23 | Multiple memory leaks in the normalization functionality in 389 Directory Server before 1.2.7.5 allow remote attackers to cause a denial of service (memory consumption) via "badly… Affected: through 1.2.7; 1.2.1; 1.2.2; 1.2.3; 1.2.5; 1.2.5; +13 more |
Showing 39