CVE-2021-4091

A double-free was found in the way 389-ds-base handles virtual attributes context in persistent searches. An attacker could send a series of search requests, forcing the server to behave unexpectedly, and crash.

Score

CVSS 3.1 7.5 High

Status

Modified - secalert@redhat.com

Published

2022-02-18

Last modified

2025-11-03

Weaknesses

CWE-415

Affected products

• 389-ds-base (Port389)
• Enterprise Linux Desktop (Redhat)
• Enterprise Linux For Ibm Z Systems (Redhat)
• Enterprise Linux For Power Big Endian (Redhat)
• Enterprise Linux For Power Little Endian (Redhat)
• Enterprise Linux For Scientific Computing (Redhat)
• Enterprise Linux Server (Redhat)
• Enterprise Linux Workstation (Redhat)

References

• https://bugzilla.redhat.com/show_bug.cgi?id=2030307
• https://lists.debian.org/debian-lts-announce/2023/04/msg00026.html
• https://lists.debian.org/debian-lts-announce/2025/01/msg00015.html