CVE-2018-14624

moderate-risk
Published 2018-09-06

A vulnerability was discovered in 389-ds-base through versions 1.3.7.10, 1.3.8.8 and 1.4.0.16. The lock controlling the error log was not correctly used when re-opening the log file in log__error_emergency(). An attacker could send a flood of modifications to a very large DN, which would cause slapd to crash.

Do I need to act?

~
1.5% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.5/10 High
NETWORK / LOW complexity

Affected Products (9)

Affected Vendors

Debian Redhat Fedoraproject

References (10)

http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00033.html
Third Party Advisory https://access.redhat.com/errata/RHSA-2018:2757
Exploit https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14624
Mailing List https://lists.debian.org/debian-lts-announce/2018/09/msg00037.html
Exploit https://pagure.io/389-ds-base/issue/49937
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00033.html
Third Party Advisory https://access.redhat.com/errata/RHSA-2018:2757
Exploit https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14624
Mailing List https://lists.debian.org/debian-lts-announce/2018/09/msg00037.html
Exploit https://pagure.io/389-ds-base/issue/49937
45
/ 100
moderate-risk
Severity 26/34 · High
Exploitability 4/34 · Minimal
Exposure 15/34 · Moderate