CVE-2024-8445

The fix for CVE-2024-2199 in 389-ds-base was insufficient to cover all scenarios. In certain product versions, an authenticated user may cause a server crash while modifying `userPassword` using malformed input.

Score

CVSS 3.1 5.7 Medium

Status

Deferred - secalert@redhat.com

Published

2024-09-05

Last modified

2025-11-06

Weaknesses

CWE-20

Affected products

• Directory Server (Redhat)
• Enterprise Linux (Redhat)
• Rhel Els (Redhat)

References

• https://access.redhat.com/errata/RHSA-2024:7434
• https://access.redhat.com/security/cve/CVE-2024-8445
• https://bugzilla.redhat.com/show_bug.cgi?id=2310110
• https://lists.debian.org/debian-lts-announce/2025/01/msg00015.html