389-ds-base before version 1.3.6 is vulnerable to an improperly NULL terminated array in the uniqueness_entry_to_config() function in the "attribute uniqueness" plugin of 389 Directory Server. An authenticated, or possibly unauthenticated, attacker could use this flaw to force an out-of-bound heap memory read, possibly triggering a crash of the LDAP service.
References
| Link | Resource |
|---|---|
| http://www.securityfocus.com/bid/95670 | Third Party Advisory VDB Entry |
| https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2591 | Issue Tracking Third Party Advisory |
| https://pagure.io/389-ds-base/issue/48986 | Patch Third Party Advisory |
| http://www.securityfocus.com/bid/95670 | Third Party Advisory VDB Entry |
| https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2591 | Issue Tracking Third Party Advisory |
| https://pagure.io/389-ds-base/issue/48986 | Patch Third Party Advisory |
Configurations
History
21 Nov 2024, 03:23
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : 5.0
v3 : 3.7 |
| References | () http://www.securityfocus.com/bid/95670 - Third Party Advisory, VDB Entry | |
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2591 - Issue Tracking, Third Party Advisory | |
| References | () https://pagure.io/389-ds-base/issue/48986 - Patch, Third Party Advisory |
Information
Published : 2018-04-30 12:29
Updated : 2024-11-21 03:23
NVD link : CVE-2017-2591
Mitre link : CVE-2017-2591
CVE.ORG link : CVE-2017-2591
JSON object : View
Products Affected
fedoraproject
- 389_directory_server
redhat
- enterprise_linux